proj/linux-patchs: Linux patch 4.4.1674.4-168

Signed-off-by: Mike Pagano <mpagano@gentoo.org>

2 files changed, 2693 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index d1220690..eefc9a18 100644
--- a/0000_README
+++ b/0000_README
@@ -707,6 +707,10 @@ Patch:  1165_linux-4.4.166.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.4.166
 
+Patch:  1166_linux-4.4.167.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.4.167
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
diff --git a/1166_linux-4.4.167.patch b/1166_linux-4.4.167.patch
new file mode 100644
index 00000000..de3a7c4b
--- /dev/null
+++ b/1166_linux-4.4.167.patch
@@ -0,0 +1,2689 @@
+diff --git a/Makefile b/Makefile
+index 64521458d35e..6b30551caee4 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 4
+-SUBLEVEL = 166
++SUBLEVEL = 167
+ EXTRAVERSION =
+ NAME = Blurry Fish Butt
+ 
+@@ -793,6 +793,9 @@ KBUILD_CFLAGS += $(call cc-option,-Wdeclaration-after-statement,)
+ # disable pointer signed / unsigned warnings in gcc 4.0
+ KBUILD_CFLAGS += $(call cc-disable-warning, pointer-sign)
+ 
++# disable stringop warnings in gcc 8+
++KBUILD_CFLAGS += $(call cc-disable-warning, stringop-truncation)
++
+ # disable invalid "can't wrap" optimizations for signed / pointers
+ KBUILD_CFLAGS	+= $(call cc-option,-fno-strict-overflow)
+ 
+diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
+index c4ee25e88a7b..e983f410135a 100644
+--- a/arch/arc/Kconfig
++++ b/arch/arc/Kconfig
+@@ -96,7 +96,7 @@ endmenu
+ 
+ choice
+ 	prompt "ARC Instruction Set"
+-	default ISA_ARCOMPACT
++	default ISA_ARCV2
+ 
+ config ISA_ARCOMPACT
+ 	bool "ARCompact ISA"
+diff --git a/arch/arc/Makefile b/arch/arc/Makefile
+index 9d64eacdd2aa..fffaff9c7b2c 100644
+--- a/arch/arc/Makefile
++++ b/arch/arc/Makefile
+@@ -12,7 +12,7 @@ ifeq ($(CROSS_COMPILE),)
+ CROSS_COMPILE := arc-linux-
+ endif
+ 
+-KBUILD_DEFCONFIG := nsim_700_defconfig
++KBUILD_DEFCONFIG := nsim_hs_defconfig
+ 
+ cflags-y	+= -fno-common -pipe -fno-builtin -mmedium-calls -D__linux__
+ cflags-$(CONFIG_ISA_ARCOMPACT)	+= -mA7
+diff --git a/arch/arc/configs/axs101_defconfig b/arch/arc/configs/axs101_defconfig
+index dbee1934dfc6..3023f91c77c2 100644
+--- a/arch/arc/configs/axs101_defconfig
++++ b/arch/arc/configs/axs101_defconfig
+@@ -17,6 +17,7 @@ CONFIG_PERF_EVENTS=y
+ # CONFIG_VM_EVENT_COUNTERS is not set
+ # CONFIG_SLUB_DEBUG is not set
+ # CONFIG_COMPAT_BRK is not set
++CONFIG_ISA_ARCOMPACT=y
+ CONFIG_MODULES=y
+ CONFIG_PARTITION_ADVANCED=y
+ CONFIG_ARC_PLAT_AXS10X=y
+@@ -97,6 +98,7 @@ CONFIG_NTFS_FS=y
+ CONFIG_TMPFS=y
+ CONFIG_JFFS2_FS=y
+ CONFIG_NFS_FS=y
++CONFIG_NFS_V3_ACL=y
+ CONFIG_NLS_CODEPAGE_437=y
+ CONFIG_NLS_ISO8859_1=y
+ # CONFIG_ENABLE_WARN_DEPRECATED is not set
+diff --git a/arch/arc/configs/axs103_defconfig b/arch/arc/configs/axs103_defconfig
+index 561eac854cc3..f18107185f53 100644
+--- a/arch/arc/configs/axs103_defconfig
++++ b/arch/arc/configs/axs103_defconfig
+@@ -103,6 +103,7 @@ CONFIG_NTFS_FS=y
+ CONFIG_TMPFS=y
+ CONFIG_JFFS2_FS=y
+ CONFIG_NFS_FS=y
++CONFIG_NFS_V3_ACL=y
+ CONFIG_NLS_CODEPAGE_437=y
+ CONFIG_NLS_ISO8859_1=y
+ # CONFIG_ENABLE_WARN_DEPRECATED is not set
+diff --git a/arch/arc/configs/axs103_smp_defconfig b/arch/arc/configs/axs103_smp_defconfig
+index aa4f261b6508..6e1dd8521d2a 100644
+--- a/arch/arc/configs/axs103_smp_defconfig
++++ b/arch/arc/configs/axs103_smp_defconfig
+@@ -104,6 +104,7 @@ CONFIG_NTFS_FS=y
+ CONFIG_TMPFS=y
+ CONFIG_JFFS2_FS=y
+ CONFIG_NFS_FS=y
++CONFIG_NFS_V3_ACL=y
+ CONFIG_NLS_CODEPAGE_437=y
+ CONFIG_NLS_ISO8859_1=y
+ # CONFIG_ENABLE_WARN_DEPRECATED is not set
+diff --git a/arch/arc/configs/nsim_700_defconfig b/arch/arc/configs/nsim_700_defconfig
+index 138f9d887957..86e5a62556a8 100644
+--- a/arch/arc/configs/nsim_700_defconfig
++++ b/arch/arc/configs/nsim_700_defconfig
+@@ -16,6 +16,7 @@ CONFIG_KALLSYMS_ALL=y
+ CONFIG_EMBEDDED=y
+ # CONFIG_SLUB_DEBUG is not set
+ # CONFIG_COMPAT_BRK is not set
++CONFIG_ISA_ARCOMPACT=y
+ CONFIG_KPROBES=y
+ CONFIG_MODULES=y
+ # CONFIG_LBDAF is not set
+diff --git a/arch/arc/configs/nsimosci_defconfig b/arch/arc/configs/nsimosci_defconfig
+index 31e1d95764ff..a4d7b919224a 100644
+--- a/arch/arc/configs/nsimosci_defconfig
++++ b/arch/arc/configs/nsimosci_defconfig
+@@ -17,6 +17,7 @@ CONFIG_KALLSYMS_ALL=y
+ CONFIG_EMBEDDED=y
+ # CONFIG_SLUB_DEBUG is not set
+ # CONFIG_COMPAT_BRK is not set
++CONFIG_ISA_ARCOMPACT=y
+ CONFIG_KPROBES=y
+ CONFIG_MODULES=y
+ # CONFIG_LBDAF is not set
+@@ -69,5 +70,6 @@ CONFIG_EXT2_FS_XATTR=y
+ CONFIG_TMPFS=y
+ # CONFIG_MISC_FILESYSTEMS is not set
+ CONFIG_NFS_FS=y
++CONFIG_NFS_V3_ACL=y
+ # CONFIG_ENABLE_WARN_DEPRECATED is not set
+ # CONFIG_ENABLE_MUST_CHECK is not set
+diff --git a/arch/arc/configs/nsimosci_hs_defconfig b/arch/arc/configs/nsimosci_hs_defconfig
+index fcae66683ca0..b3fb49c8bd14 100644
+--- a/arch/arc/configs/nsimosci_hs_defconfig
++++ b/arch/arc/configs/nsimosci_hs_defconfig
+@@ -69,5 +69,6 @@ CONFIG_EXT2_FS_XATTR=y
+ CONFIG_TMPFS=y
+ # CONFIG_MISC_FILESYSTEMS is not set
+ CONFIG_NFS_FS=y
++CONFIG_NFS_V3_ACL=y
+ # CONFIG_ENABLE_WARN_DEPRECATED is not set
+ # CONFIG_ENABLE_MUST_CHECK is not set
+diff --git a/arch/arc/configs/nsimosci_hs_smp_defconfig b/arch/arc/configs/nsimosci_hs_smp_defconfig
+index b01b659168ea..710c167bbdd8 100644
+--- a/arch/arc/configs/nsimosci_hs_smp_defconfig
++++ b/arch/arc/configs/nsimosci_hs_smp_defconfig
+@@ -88,6 +88,7 @@ CONFIG_EXT2_FS_XATTR=y
+ CONFIG_TMPFS=y
+ # CONFIG_MISC_FILESYSTEMS is not set
+ CONFIG_NFS_FS=y
++CONFIG_NFS_V3_ACL=y
+ # CONFIG_ENABLE_WARN_DEPRECATED is not set
+ # CONFIG_ENABLE_MUST_CHECK is not set
+ CONFIG_FTRACE=y
+diff --git a/arch/arc/configs/tb10x_defconfig b/arch/arc/configs/tb10x_defconfig
+index 3b4dc9cebcf1..7469b754ac77 100644
+--- a/arch/arc/configs/tb10x_defconfig
++++ b/arch/arc/configs/tb10x_defconfig
+@@ -19,6 +19,7 @@ CONFIG_KALLSYMS_ALL=y
+ # CONFIG_AIO is not set
+ CONFIG_EMBEDDED=y
+ # CONFIG_COMPAT_BRK is not set
++CONFIG_ISA_ARCOMPACT=y
+ CONFIG_SLAB=y
+ CONFIG_MODULES=y
+ CONFIG_MODULE_FORCE_LOAD=y
+diff --git a/arch/arc/configs/vdk_hs38_defconfig b/arch/arc/configs/vdk_hs38_defconfig
+index a07f20de221b..772073e5ba04 100644
+--- a/arch/arc/configs/vdk_hs38_defconfig
++++ b/arch/arc/configs/vdk_hs38_defconfig
+@@ -89,6 +89,7 @@ CONFIG_NTFS_FS=y
+ CONFIG_TMPFS=y
+ CONFIG_JFFS2_FS=y
+ CONFIG_NFS_FS=y
++CONFIG_NFS_V3_ACL=y
+ CONFIG_NLS_CODEPAGE_437=y
+ CONFIG_NLS_ISO8859_1=y
+ # CONFIG_ENABLE_WARN_DEPRECATED is not set
+diff --git a/arch/arc/configs/vdk_hs38_smp_defconfig b/arch/arc/configs/vdk_hs38_smp_defconfig
+index f36c047b33ca..50e215a163ff 100644
+--- a/arch/arc/configs/vdk_hs38_smp_defconfig
++++ b/arch/arc/configs/vdk_hs38_smp_defconfig
+@@ -91,6 +91,7 @@ CONFIG_NTFS_FS=y
+ CONFIG_TMPFS=y
+ CONFIG_JFFS2_FS=y
+ CONFIG_NFS_FS=y
++CONFIG_NFS_V3_ACL=y
+ CONFIG_NLS_CODEPAGE_437=y
+ CONFIG_NLS_ISO8859_1=y
+ # CONFIG_ENABLE_WARN_DEPRECATED is not set
+diff --git a/arch/mips/include/asm/syscall.h b/arch/mips/include/asm/syscall.h
+index 47bc45a67e9b..032a497356f3 100644
+--- a/arch/mips/include/asm/syscall.h
++++ b/arch/mips/include/asm/syscall.h
+@@ -51,7 +51,7 @@ static inline unsigned long mips_get_syscall_arg(unsigned long *arg,
+ #ifdef CONFIG_64BIT
+ 	case 4: case 5: case 6: case 7:
+ #ifdef CONFIG_MIPS32_O32
+-		if (test_thread_flag(TIF_32BIT_REGS))
++		if (test_tsk_thread_flag(task, TIF_32BIT_REGS))
+ 			return get_user(*arg, (int *)usp + n);
+ 		else
+ #endif
+diff --git a/arch/mips/ralink/mt7620.c b/arch/mips/ralink/mt7620.c
+index c5f45fc96c74..9c19f5493b85 100644
+--- a/arch/mips/ralink/mt7620.c
++++ b/arch/mips/ralink/mt7620.c
+@@ -81,7 +81,7 @@ static struct rt2880_pmx_func pcie_rst_grp[] = {
+ };
+ static struct rt2880_pmx_func nd_sd_grp[] = {
+ 	FUNC("nand", MT7620_GPIO_MODE_NAND, 45, 15),
+-	FUNC("sd", MT7620_GPIO_MODE_SD, 45, 15)
++	FUNC("sd", MT7620_GPIO_MODE_SD, 47, 13)
+ };
+ 
+ static struct rt2880_pmx_group mt7620a_pinmux_data[] = {
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index 2b71f2c03b9e..a5b533aea958 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -4174,9 +4174,9 @@ static void mmu_pte_write_flush_tlb(struct kvm_vcpu *vcpu, bool zap_page,
+ }
+ 
+ static u64 mmu_pte_write_fetch_gpte(struct kvm_vcpu *vcpu, gpa_t *gpa,
+-				    const u8 *new, int *bytes)
++				    int *bytes)
+ {
+-	u64 gentry;
++	u64 gentry = 0;
+ 	int r;
+ 
+ 	/*
+@@ -4188,22 +4188,12 @@ static u64 mmu_pte_write_fetch_gpte(struct kvm_vcpu *vcpu, gpa_t *gpa,
+ 		/* Handle a 32-bit guest writing two halves of a 64-bit gpte */
+ 		*gpa &= ~(gpa_t)7;
+ 		*bytes = 8;
+-		r = kvm_vcpu_read_guest(vcpu, *gpa, &gentry, 8);
+-		if (r)
+-			gentry = 0;
+-		new = (const u8 *)&gentry;
+ 	}
+ 
+-	switch (*bytes) {
+-	case 4:
+-		gentry = *(const u32 *)new;
+-		break;
+-	case 8:
+-		gentry = *(const u64 *)new;
+-		break;
+-	default:
+-		gentry = 0;
+-		break;
++	if (*bytes == 4 || *bytes == 8) {
++		r = kvm_vcpu_read_guest_atomic(vcpu, *gpa, &gentry, *bytes);
++		if (r)
++			gentry = 0;
+ 	}
+ 
+ 	return gentry;
+@@ -4313,8 +4303,6 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
+ 
+ 	pgprintk("%s: gpa %llx bytes %d\n", __func__, gpa, bytes);
+ 
+-	gentry = mmu_pte_write_fetch_gpte(vcpu, &gpa, new, &bytes);
+-
+ 	/*
+ 	 * No need to care whether allocation memory is successful
+ 	 * or not since pte prefetch is skiped if it does not have
+@@ -4323,6 +4311,9 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
+ 	mmu_topup_memory_caches(vcpu);
+ 
+ 	spin_lock(&vcpu->kvm->mmu_lock);
++
++	gentry = mmu_pte_write_fetch_gpte(vcpu, &gpa, &bytes);
++
+ 	++vcpu->kvm->stat.mmu_pte_write;
+ 	kvm_mmu_audit(vcpu, AUDIT_PRE_PTE_WRITE);
+ 
+diff --git a/arch/xtensa/kernel/asm-offsets.c b/arch/xtensa/kernel/asm-offsets.c
+index b123ace3b67c..cbefed1800c1 100644
+--- a/arch/xtensa/kernel/asm-offsets.c
++++ b/arch/xtensa/kernel/asm-offsets.c
+@@ -90,14 +90,14 @@ int main(void)
+ 	DEFINE(THREAD_SP, offsetof (struct task_struct, thread.sp));
+ 	DEFINE(THREAD_CPENABLE, offsetof (struct thread_info, cpenable));
+ #if XTENSA_HAVE_COPROCESSORS
+-	DEFINE(THREAD_XTREGS_CP0, offsetof (struct thread_info, xtregs_cp));
+-	DEFINE(THREAD_XTREGS_CP1, offsetof (struct thread_info, xtregs_cp));
+-	DEFINE(THREAD_XTREGS_CP2, offsetof (struct thread_info, xtregs_cp));
+-	DEFINE(THREAD_XTREGS_CP3, offsetof (struct thread_info, xtregs_cp));
+-	DEFINE(THREAD_XTREGS_CP4, offsetof (struct thread_info, xtregs_cp));
+-	DEFINE(THREAD_XTREGS_CP5, offsetof (struct thread_info, xtregs_cp));
+-	DEFINE(THREAD_XTREGS_CP6, offsetof (struct thread_info, xtregs_cp));
+-	DEFINE(THREAD_XTREGS_CP7, offsetof (struct thread_info, xtregs_cp));
++	DEFINE(THREAD_XTREGS_CP0, offsetof(struct thread_info, xtregs_cp.cp0));
++	DEFINE(THREAD_XTREGS_CP1, offsetof(struct thread_info, xtregs_cp.cp1));
++	DEFINE(THREAD_XTREGS_CP2, offsetof(struct thread_info, xtregs_cp.cp2));
++	DEFINE(THREAD_XTREGS_CP3, offsetof(struct thread_info, xtregs_cp.cp3));
++	DEFINE(THREAD_XTREGS_CP4, offsetof(struct thread_info, xtregs_cp.cp4));
++	DEFINE(THREAD_XTREGS_CP5, offsetof(struct thread_info, xtregs_cp.cp5));
++	DEFINE(THREAD_XTREGS_CP6, offsetof(struct thread_info, xtregs_cp.cp6));
++	DEFINE(THREAD_XTREGS_CP7, offsetof(struct thread_info, xtregs_cp.cp7));
+ #endif
+ 	DEFINE(THREAD_XTREGS_USER, offsetof (struct thread_info, xtregs_user));
+ 	DEFINE(XTREGS_USER_SIZE, sizeof(xtregs_user_t));
+diff --git a/arch/xtensa/kernel/process.c b/arch/xtensa/kernel/process.c
+index 1c85323f01d7..df70d47d14ab 100644
+--- a/arch/xtensa/kernel/process.c
++++ b/arch/xtensa/kernel/process.c
+@@ -83,18 +83,21 @@ void coprocessor_release_all(struct thread_info *ti)
+ 
+ void coprocessor_flush_all(struct thread_info *ti)
+ {
+-	unsigned long cpenable;
++	unsigned long cpenable, old_cpenable;
+ 	int i;
+ 
+ 	preempt_disable();
+ 
++	RSR_CPENABLE(old_cpenable);
+ 	cpenable = ti->cpenable;
++	WSR_CPENABLE(cpenable);
+ 
+ 	for (i = 0; i < XCHAL_CP_MAX; i++) {
+ 		if ((cpenable & 1) != 0 && coprocessor_owner[i] == ti)
+ 			coprocessor_flush(ti, i);
+ 		cpenable >>= 1;
+ 	}
++	WSR_CPENABLE(old_cpenable);
+ 
+ 	preempt_enable();
+ }
+diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
+index be26f625bb3e..941ace052130 100644
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -1781,6 +1781,12 @@ static void atc_free_chan_resources(struct dma_chan *chan)
+ 	atchan->descs_allocated = 0;
+ 	atchan->status = 0;
+ 
++	/*
++	 * Free atslave allocated in at_dma_xlate()
++	 */
++	kfree(chan->private);
++	chan->private = NULL;
++
+ 	dev_vdbg(chan2dev(chan), "free_chan_resources: done\n");
+ }
+ 
+@@ -1815,7 +1821,7 @@ static struct dma_chan *at_dma_xlate(struct of_phandle_args *dma_spec,
+ 	dma_cap_zero(mask);
+ 	dma_cap_set(DMA_SLAVE, mask);
+ 
+-	atslave = devm_kzalloc(&dmac_pdev->dev, sizeof(*atslave), GFP_KERNEL);
++	atslave = kzalloc(sizeof(*atslave), GFP_KERNEL);
+ 	if (!atslave)
+ 		return NULL;
+ 
+@@ -2146,6 +2152,8 @@ static int at_dma_remove(struct platform_device *pdev)
+ 	struct resource		*io;
+ 
+ 	at_dma_off(atdma);
++	if (pdev->dev.of_node)
++		of_dma_controller_free(pdev->dev.of_node);
+ 	dma_async_device_unregister(&atdma->dma_common);
+ 
+ 	dma_pool_destroy(atdma->memset_pool);
+diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
+index 498a94069e6b..1acebd64fded 100644
+--- a/drivers/gpu/drm/ast/ast_main.c
++++ b/drivers/gpu/drm/ast/ast_main.c
+@@ -557,7 +557,8 @@ int ast_driver_unload(struct drm_device *dev)
+ 	drm_mode_config_cleanup(dev);
+ 
+ 	ast_mm_fini(ast);
+-	pci_iounmap(dev->pdev, ast->ioregs);
++	if (ast->ioregs != ast->regs + AST_IO_MM_OFFSET)
++		pci_iounmap(dev->pdev, ast->ioregs);
+ 	pci_iounmap(dev->pdev, ast->regs);
+ 	kfree(ast);
+ 	return 0;
+diff --git a/drivers/gpu/drm/gma500/mdfld_intel_display.c b/drivers/gpu/drm/gma500/mdfld_intel_display.c
+index acd38344b302..764094dd30dd 100644
+--- a/drivers/gpu/drm/gma500/mdfld_intel_display.c
++++ b/drivers/gpu/drm/gma500/mdfld_intel_display.c
+@@ -99,7 +99,7 @@ void mdfldWaitForPipeEnable(struct drm_device *dev, int pipe)
+ 	/* Wait for for the pipe enable to take effect. */
+ 	for (count = 0; count < COUNT_MAX; count++) {
+ 		temp = REG_READ(map->conf);
+-		if ((temp & PIPEACONF_PIPE_STATE) == 1)
++		if (temp & PIPEACONF_PIPE_STATE)
+ 			break;
+ 	}
+ }
+diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
+index 0cbc7ceb9a55..1610accfed0b 100644
+--- a/drivers/infiniband/ulp/iser/iser_verbs.c
++++ b/drivers/infiniband/ulp/iser/iser_verbs.c
+@@ -1289,7 +1289,9 @@ u8 iser_check_task_pi_status(struct iscsi_iser_task *iser_task,
+ 					 IB_MR_CHECK_SIG_STATUS, &mr_status);
+ 		if (ret) {
+ 			pr_err("ib_check_mr_status failed, ret %d\n", ret);
+-			goto err;
++			/* Not a lot we can do, return ambiguous guard error */
++			*sector = 0;
++			return 0x1;
+ 		}
+ 
+ 		if (mr_status.fail_status & IB_MR_CHECK_SIG_STATUS) {
+@@ -1317,7 +1319,4 @@ u8 iser_check_task_pi_status(struct iscsi_iser_task *iser_task,
+ 	}
+ 
+ 	return 0;
+-err:
+-	/* Not alot we can do here, return ambiguous guard error */
+-	return 0x1;
+ }
+diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
+index 2e52015634f9..f55dcdf99bc5 100644
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -483,18 +483,18 @@ static const u8 xboxone_hori_init[] = {
+ };
+ 
+ /*
+- * This packet is required for some of the PDP pads to start
++ * This packet is required for most (all?) of the PDP pads to start
+  * sending input reports. These pads include: (0x0e6f:0x02ab),
+- * (0x0e6f:0x02a4).
++ * (0x0e6f:0x02a4), (0x0e6f:0x02a6).
+  */
+ static const u8 xboxone_pdp_init1[] = {
+ 	0x0a, 0x20, 0x00, 0x03, 0x00, 0x01, 0x14
+ };
+ 
+ /*
+- * This packet is required for some of the PDP pads to start
++ * This packet is required for most (all?) of the PDP pads to start
+  * sending input reports. These pads include: (0x0e6f:0x02ab),
+- * (0x0e6f:0x02a4).
++ * (0x0e6f:0x02a4), (0x0e6f:0x02a6).
+  */
+ static const u8 xboxone_pdp_init2[] = {
+ 	0x06, 0x20, 0x00, 0x02, 0x01, 0x00
+@@ -530,12 +530,8 @@ static const struct xboxone_init_packet xboxone_init_packets[] = {
+ 	XBOXONE_INIT_PKT(0x0e6f, 0x0165, xboxone_hori_init),
+ 	XBOXONE_INIT_PKT(0x0f0d, 0x0067, xboxone_hori_init),
+ 	XBOXONE_INIT_PKT(0x0000, 0x0000, xboxone_fw2015_init),
+-	XBOXONE_INIT_PKT(0x0e6f, 0x02ab, xboxone_pdp_init1),
+-	XBOXONE_INIT_PKT(0x0e6f, 0x02ab, xboxone_pdp_init2),
+-	XBOXONE_INIT_PKT(0x0e6f, 0x02a4, xboxone_pdp_init1),
+-	XBOXONE_INIT_PKT(0x0e6f, 0x02a4, xboxone_pdp_init2),
+-	XBOXONE_INIT_PKT(0x0e6f, 0x02a6, xboxone_pdp_init1),
+-	XBOXONE_INIT_PKT(0x0e6f, 0x02a6, xboxone_pdp_init2),
++	XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_init1),
++	XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_init2),
+ 	XBOXONE_INIT_PKT(0x24c6, 0x541a, xboxone_rumblebegin_init),
+ 	XBOXONE_INIT_PKT(0x24c6, 0x542a, xboxone_rumblebegin_init),
+ 	XBOXONE_INIT_PKT(0x24c6, 0x543a, xboxone_rumblebegin_init),
+diff --git a/drivers/input/keyboard/matrix_keypad.c b/drivers/input/keyboard/matrix_keypad.c
+index 795fa353de7c..c64d87442a62 100644
+--- a/drivers/input/keyboard/matrix_keypad.c
++++ b/drivers/input/keyboard/matrix_keypad.c
+@@ -405,7 +405,7 @@ matrix_keypad_parse_dt(struct device *dev)
+ 	struct matrix_keypad_platform_data *pdata;
+ 	struct device_node *np = dev->of_node;
+ 	unsigned int *gpios;
+-	int i, nrow, ncol;
++	int ret, i, nrow, ncol;
+ 
+ 	if (!np) {
+ 		dev_err(dev, "device lacks DT data\n");
+@@ -447,12 +447,19 @@ matrix_keypad_parse_dt(struct device *dev)
+ 		return ERR_PTR(-ENOMEM);
+ 	}
+ 
+-	for (i = 0; i < pdata->num_row_gpios; i++)
+-		gpios[i] = of_get_named_gpio(np, "row-gpios", i);
++	for (i = 0; i < nrow; i++) {
++		ret = of_get_named_gpio(np, "row-gpios", i);
++		if (ret < 0)
++			return ERR_PTR(ret);
++		gpios[i] = ret;
++	}
+ 
+-	for (i = 0; i < pdata->num_col_gpios; i++)
+-		gpios[pdata->num_row_gpios + i] =
+-			of_get_named_gpio(np, "col-gpios", i);
++	for (i = 0; i < ncol; i++) {
++		ret = of_get_named_gpio(np, "col-gpios", i);
++		if (ret < 0)
++			return ERR_PTR(ret);
++		gpios[nrow + i] = ret;
++	}
+ 
+ 	pdata->row_gpios = gpios;
+ 	pdata->col_gpios = &gpios[pdata->num_row_gpios];
+@@ -479,10 +486,8 @@ static int matrix_keypad_probe(struct platform_device *pdev)
+ 	pdata = dev_get_platdata(&pdev->dev);
+ 	if (!pdata) {
+ 		pdata = matrix_keypad_parse_dt(&pdev->dev);
+-		if (IS_ERR(pdata)) {
+-			dev_err(&pdev->dev, "no platform data defined\n");
++		if (IS_ERR(pdata))
+ 			return PTR_ERR(pdata);
+-		}
+ 	} else if (!pdata->keymap_data) {
+ 		dev_err(&pdev->dev, "no keymap data defined\n");
+ 		return -EINVAL;
+diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
+index b3119589a444..471984ec2db0 100644
+--- a/drivers/input/mouse/elan_i2c_core.c
++++ b/drivers/input/mouse/elan_i2c_core.c
+@@ -1253,6 +1253,9 @@ static const struct acpi_device_id elan_acpi_id[] = {
+ 	{ "ELAN0618", 0 },
+ 	{ "ELAN061C", 0 },
+ 	{ "ELAN061D", 0 },
++	{ "ELAN061E", 0 },
++	{ "ELAN0620", 0 },
++	{ "ELAN0621", 0 },
+ 	{ "ELAN0622", 0 },
+ 	{ "ELAN1000", 0 },
+ 	{ }
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 49b266433f4c..7feaa82f8c7c 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -2977,7 +2977,7 @@ static int copy_context_table(struct intel_iommu *iommu,
+ 			}
+ 
+ 			if (old_ce)
+-				iounmap(old_ce);
++				memunmap(old_ce);
+ 
+ 			ret = 0;
+ 			if (devfn < 0x80)
+diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
+index 10068a481e22..cbde03e509c1 100644
+--- a/drivers/iommu/intel-svm.c
++++ b/drivers/iommu/intel-svm.c
+@@ -558,7 +558,7 @@ static irqreturn_t prq_event_thread(int irq, void *d)
+ 			pr_err("%s: Page request without PASID: %08llx %08llx\n",
+ 			       iommu->name, ((unsigned long long *)req)[0],
+ 			       ((unsigned long long *)req)[1]);
+-			goto bad_req;
++			goto no_pasid;
+ 		}
+ 
+ 		if (!svm || svm->pasid != req->pasid) {
+diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c
+index 624e7ff76166..9101be1a6b59 100644
+--- a/drivers/iommu/ipmmu-vmsa.c
++++ b/drivers/iommu/ipmmu-vmsa.c
+@@ -372,6 +372,9 @@ static int ipmmu_domain_init_context(struct ipmmu_vmsa_domain *domain)
+ 
+ static void ipmmu_domain_destroy_context(struct ipmmu_vmsa_domain *domain)
+ {
++	if (!domain->mmu)
++		return;
++
+ 	/*
+ 	 * Disable the context. Flush the TLB as required when modifying the
+ 	 * context registers.
+diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c
+index 7385f98dd54b..51a5b51ec467 100644
+--- a/drivers/leds/led-class.c
++++ b/drivers/leds/led-class.c
+@@ -247,12 +247,13 @@ void led_classdev_unregister(struct led_classdev *led_cdev)
+ 	up_write(&led_cdev->trigger_lock);
+ #endif
+ 
+-	cancel_work_sync(&led_cdev->set_brightness_work);
+-
+ 	/* Stop blinking */
+ 	led_stop_software_blink(led_cdev);
++
+ 	led_set_brightness(led_cdev, LED_OFF);
+ 
++	flush_work(&led_cdev->set_brightness_work);
++
+ 	device_unregister(led_cdev->dev);
+ 
+ 	down_write(&leds_list_lock);
+diff --git a/drivers/leds/leds-gpio.c b/drivers/leds/leds-gpio.c
+index 5db4515a4fd7..df186b38da78 100644
+--- a/drivers/leds/leds-gpio.c
++++ b/drivers/leds/leds-gpio.c
+@@ -118,8 +118,8 @@ static int create_gpio_led(const struct gpio_led *template,
+ 			return ret;
+ 
+ 		led_dat->gpiod = gpio_to_desc(template->gpio);
+-		if (IS_ERR(led_dat->gpiod))
+-			return PTR_ERR(led_dat->gpiod);
++		if (!led_dat->gpiod)
++			return -EINVAL;
+ 	}
+ 
+ 	led_dat->cdev.name = template->name;
+diff --git a/drivers/leds/leds-pwm.c b/drivers/leds/leds-pwm.c
+index 1d07e3e83d29..3149dbece146 100644
+--- a/drivers/leds/leds-pwm.c
++++ b/drivers/leds/leds-pwm.c
+@@ -132,6 +132,7 @@ static int led_pwm_add(struct device *dev, struct led_pwm_priv *priv,
+ 	ret = led_classdev_register(dev, &led_data->cdev);
+ 	if (ret == 0) {
+ 		priv->num_leds++;
++		led_pwm_set(&led_data->cdev, led_data->cdev.brightness);
+ 	} else {
+ 		dev_err(dev, "failed to register PWM led for %s: %d\n",
+ 			led->name, ret);
+diff --git a/drivers/media/usb/em28xx/em28xx-dvb.c b/drivers/media/usb/em28xx/em28xx-dvb.c
+index 357be76c7a55..5502a0fb94fd 100644
+--- a/drivers/media/usb/em28xx/em28xx-dvb.c
++++ b/drivers/media/usb/em28xx/em28xx-dvb.c
+@@ -1806,6 +1806,8 @@ static int em28xx_dvb_fini(struct em28xx *dev)
+ 		}
+ 	}
+ 
++	em28xx_unregister_dvb(dvb);
++
+ 	/* remove I2C SEC */
+ 	client = dvb->i2c_client_sec;
+ 	if (client) {
+@@ -1827,7 +1829,6 @@ static int em28xx_dvb_fini(struct em28xx *dev)
+ 		i2c_unregister_device(client);
+ 	}
+ 
+-	em28xx_unregister_dvb(dvb);
+ 	kfree(dvb);
+ 	dev->dvb = NULL;
+ 	kref_put(&dev->ref, em28xx_free_device);
+diff --git a/drivers/misc/mic/scif/scif_rma.c b/drivers/misc/mic/scif/scif_rma.c
+index 6a451bd65bf3..8bd63128d536 100644
+--- a/drivers/misc/mic/scif/scif_rma.c
++++ b/drivers/misc/mic/scif/scif_rma.c
+@@ -414,7 +414,7 @@ static int scif_create_remote_lookup(struct scif_dev *remote_dev,
+ 		if (err)
+ 			goto error_window;
+ 		err = scif_map_page(&window->num_pages_lookup.lookup[j],
+-				    vmalloc_dma_phys ?
++				    vmalloc_num_pages ?
+ 				    vmalloc_to_page(&window->num_pages[i]) :
+ 				    virt_to_page(&window->num_pages[i]),
+ 				    remote_dev);
+diff --git a/drivers/net/can/rcar_can.c b/drivers/net/can/rcar_can.c
+index bc46be39549d..9d93492ddfcc 100644
+--- a/drivers/net/can/rcar_can.c
++++ b/drivers/net/can/rcar_can.c
+@@ -24,6 +24,9 @@
+ 
+ #define RCAR_CAN_DRV_NAME	"rcar_can"
+ 
++#define RCAR_SUPPORTED_CLOCKS	(BIT(CLKR_CLKP1) | BIT(CLKR_CLKP2) | \
++				 BIT(CLKR_CLKEXT))
++
+ /* Mailbox configuration:
+  * mailbox 60 - 63 - Rx FIFO mailboxes
+  * mailbox 56 - 59 - Tx FIFO mailboxes
+@@ -789,7 +792,7 @@ static int rcar_can_probe(struct platform_device *pdev)
+ 		goto fail_clk;
+ 	}
+ 
+-	if (clock_select >= ARRAY_SIZE(clock_names)) {
++	if (!(BIT(clock_select) & RCAR_SUPPORTED_CLOCKS)) {
+ 		err = -EINVAL;
+ 		dev_err(&pdev->dev, "invalid CAN clock selected\n");
+ 		goto fail_clk;
+diff --git a/drivers/net/ethernet/amd/sunlance.c b/drivers/net/ethernet/amd/sunlance.c
+index 7847638bdd22..8914170fccff 100644
+--- a/drivers/net/ethernet/amd/sunlance.c
++++ b/drivers/net/ethernet/amd/sunlance.c
+@@ -1419,7 +1419,7 @@ static int sparc_lance_probe_one(struct platform_device *op,
+ 
+ 			prop = of_get_property(nd, "tpe-link-test?", NULL);
+ 			if (!prop)
+-				goto no_link_test;
++				goto node_put;
+ 
+ 			if (strcmp(prop, "true")) {
+ 				printk(KERN_NOTICE "SunLance: warning: overriding option "
+@@ -1428,6 +1428,8 @@ static int sparc_lance_probe_one(struct platform_device *op,
+ 				       "to ecd@skynet.be\n");
+ 				auxio_set_lte(AUXIO_LTE_ON);
+ 			}
++node_put:
++			of_node_put(nd);
+ no_link_test:
+ 			lp->auto_select = 1;
+ 			lp->tpe = 0;
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+index 1ea068815419..2491cdc2535c 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+@@ -2291,6 +2291,13 @@ void bnx2x_igu_clear_sb_gen(struct bnx2x *bp, u8 func, u8 idu_sb_id,
+ #define PMF_DMAE_C(bp)			(BP_PORT(bp) * MAX_DMAE_C_PER_PORT + \
+ 					 E1HVN_MAX)
+ 
++/* Following is the DMAE channel number allocation for the clients.
++ *   MFW: OCBB/OCSD implementations use DMAE channels 14/15 respectively.
++ *   Driver: 0-3 and 8-11 (for PF dmae operations)
++ *           4 and 12 (for stats requests)
++ */
++#define BNX2X_FW_DMAE_C                 13 /* Channel for FW DMAE operations */
++
+ /* PCIE link and speed */
+ #define PCICFG_LINK_WIDTH		0x1f00000
+ #define PCICFG_LINK_WIDTH_SHIFT		20
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
+index ff702a707a91..343e3366d751 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
+@@ -5931,6 +5931,7 @@ static inline int bnx2x_func_send_start(struct bnx2x *bp,
+ 	rdata->sd_vlan_tag	= cpu_to_le16(start_params->sd_vlan_tag);
+ 	rdata->path_id		= BP_PATH(bp);
+ 	rdata->network_cos_mode	= start_params->network_cos_mode;
++	rdata->dmae_cmd_id	= BNX2X_FW_DMAE_C;
+ 
+ 	rdata->vxlan_dst_port	= cpu_to_le16(start_params->vxlan_dst_port);
+ 	rdata->geneve_dst_port	= cpu_to_le16(start_params->geneve_dst_port);
+diff --git a/drivers/net/ethernet/faraday/ftmac100.c b/drivers/net/ethernet/faraday/ftmac100.c
+index dce5f7b7f772..05e1f923f49e 100644
+--- a/drivers/net/ethernet/faraday/ftmac100.c
++++ b/drivers/net/ethernet/faraday/ftmac100.c
+@@ -865,11 +865,10 @@ static irqreturn_t ftmac100_interrupt(int irq, void *dev_id)
+ 	struct net_device *netdev = dev_id;
+ 	struct ftmac100 *priv = netdev_priv(netdev);
+ 
+-	if (likely(netif_running(netdev))) {
+-		/* Disable interrupts for polling */
+-		ftmac100_disable_all_int(priv);
++	/* Disable interrupts for polling */
++	ftmac100_disable_all_int(priv);
++	if (likely(netif_running(netdev)))
+ 		napi_schedule(&priv->napi);
+-	}
+ 
+ 	return IRQ_HANDLED;
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx4/alloc.c b/drivers/net/ethernet/mellanox/mlx4/alloc.c
+index 0c51c69f802f..a4912b11e54f 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/alloc.c
++++ b/drivers/net/ethernet/mellanox/mlx4/alloc.c
+@@ -339,7 +339,7 @@ void mlx4_zone_allocator_destroy(struct mlx4_zone_allocator *zone_alloc)
+ static u32 __mlx4_alloc_from_zone(struct mlx4_zone_entry *zone, int count,
+ 				  int align, u32 skip_mask, u32 *puid)
+ {
+-	u32 uid;
++	u32 uid = 0;
+ 	u32 res;
+ 	struct mlx4_zone_allocator *zone_alloc = zone->allocator;
+ 	struct mlx4_zone_entry *curr_node;
+diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+index f5fdbd53d052..db40387ffaf6 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+@@ -537,8 +537,8 @@ struct slave_list {
+ struct resource_allocator {
+ 	spinlock_t alloc_lock; /* protect quotas */
+ 	union {
+-		int res_reserved;
+-		int res_port_rsvd[MLX4_MAX_PORTS];
++		unsigned int res_reserved;
++		unsigned int res_port_rsvd[MLX4_MAX_PORTS];
+ 	};
+ 	union {
+ 		int res_free;
+diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c
+index 93195191f45b..53833c06696f 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/mr.c
++++ b/drivers/net/ethernet/mellanox/mlx4/mr.c
+@@ -366,6 +366,7 @@ int mlx4_mr_hw_write_mpt(struct mlx4_dev *dev, struct mlx4_mr *mmr,
+ 			container_of((void *)mpt_entry, struct mlx4_cmd_mailbox,
+ 				     buf);
+ 
++		(*mpt_entry)->lkey = 0;
+ 		err = mlx4_SW2HW_MPT(dev, mailbox, key);
+ 	}
+ 
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.c b/drivers/net/ethernet/qlogic/qed/qed_int.c
+index 9cc9d62c1fec..8b15a018d625 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_int.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_int.c
+@@ -177,6 +177,8 @@ static int qed_int_attentions(struct qed_hwfn *p_hwfn)
+ 	 */
+ 	do {
+ 		index = p_sb_attn->sb_index;
++		/* finish reading index before the loop condition */
++		dma_rmb();
+ 		attn_bits = le32_to_cpu(p_sb_attn->atten_bits);
+ 		attn_acks = le32_to_cpu(p_sb_attn->atten_ack);
+ 	} while (index != p_sb_attn->sb_index);
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
+index 35e1468d8196..b8ae6ed5c7ba 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
+@@ -1124,9 +1124,9 @@ static int qed_drain(struct qed_dev *cdev)
+ 			return -EBUSY;
+ 		}
+ 		rc = qed_mcp_drain(hwfn, ptt);
++		qed_ptt_release(hwfn, ptt);
+ 		if (rc)
+ 			return rc;
+-		qed_ptt_release(hwfn, ptt);
+ 	}
+ 
+ 	return 0;
+diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c
+index e7034c55e796..6ef9188384ce 100644
+--- a/drivers/net/rionet.c
++++ b/drivers/net/rionet.c
+@@ -215,9 +215,9 @@ static int rionet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ 			 * it just report sending a packet to the target
+ 			 * (without actual packet transfer).
+ 			 */
+-			dev_kfree_skb_any(skb);
+ 			ndev->stats.tx_packets++;
+ 			ndev->stats.tx_bytes += skb->len;
++			dev_kfree_skb_any(skb);
+ 		}
+ 	}
+ 
+diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
+index 76465b117b72..f1f8227e7342 100644
+--- a/drivers/net/usb/ipheth.c
++++ b/drivers/net/usb/ipheth.c
+@@ -140,7 +140,6 @@ struct ipheth_device {
+ 	struct usb_device *udev;
+ 	struct usb_interface *intf;
+ 	struct net_device *net;
+-	struct sk_buff *tx_skb;
+ 	struct urb *tx_urb;
+ 	struct urb *rx_urb;
+ 	unsigned char *tx_buf;
+@@ -229,6 +228,7 @@ static void ipheth_rcvbulk_callback(struct urb *urb)
+ 	case -ENOENT:
+ 	case -ECONNRESET:
+ 	case -ESHUTDOWN:
++	case -EPROTO:
+ 		return;
+ 	case 0:
+ 		break;
+@@ -280,7 +280,6 @@ static void ipheth_sndbulk_callback(struct urb *urb)
+ 		dev_err(&dev->intf->dev, "%s: urb status: %d\n",
+ 		__func__, status);
+ 
+-	dev_kfree_skb_irq(dev->tx_skb);
+ 	netif_wake_queue(dev->net);
+ }
+ 
+@@ -410,7 +409,7 @@ static int ipheth_tx(struct sk_buff *skb, struct net_device *net)
+ 	if (skb->len > IPHETH_BUF_SIZE) {
+ 		WARN(1, "%s: skb too large: %d bytes\n", __func__, skb->len);
+ 		dev->net->stats.tx_dropped++;
+-		dev_kfree_skb_irq(skb);
++		dev_kfree_skb_any(skb);
+ 		return NETDEV_TX_OK;
+ 	}
+ 
+@@ -430,12 +429,11 @@ static int ipheth_tx(struct sk_buff *skb, struct net_device *net)
+ 		dev_err(&dev->intf->dev, "%s: usb_submit_urb: %d\n",
+ 			__func__, retval);
+ 		dev->net->stats.tx_errors++;
+-		dev_kfree_skb_irq(skb);
++		dev_kfree_skb_any(skb);
+ 	} else {
+-		dev->tx_skb = skb;
+-
+ 		dev->net->stats.tx_packets++;
+ 		dev->net->stats.tx_bytes += skb->len;
++		dev_consume_skb_any(skb);
+ 		netif_stop_queue(net);
+ 	}
+ 
+diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
+index 05413176a5d6..ab480ea6d95a 100644
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -2515,6 +2515,10 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
+ 	if (param->no_vif)
+ 		ieee80211_hw_set(hw, NO_AUTO_VIF);
+ 
++	tasklet_hrtimer_init(&data->beacon_timer,
++			     mac80211_hwsim_beacon,
++			     CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
++
+ 	err = ieee80211_register_hw(hw);
+ 	if (err < 0) {
+ 		printk(KERN_DEBUG "mac80211_hwsim: ieee80211_register_hw failed (%d)\n",
+@@ -2539,10 +2543,6 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
+ 				    data->debugfs,
+ 				    data, &hwsim_simulate_radar);
+ 
+-	tasklet_hrtimer_init(&data->beacon_timer,
+-			     mac80211_hwsim_beacon,
+-			     CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
+-
+ 	spin_lock_bh(&hwsim_radio_lock);
+ 	list_add_tail(&data->list, &hwsim_radios);
+ 	spin_unlock_bh(&hwsim_radio_lock);
+diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c
+index 15dc7a398b90..f01d24baff7c 100644
+--- a/drivers/net/wireless/ti/wlcore/cmd.c
++++ b/drivers/net/wireless/ti/wlcore/cmd.c
+@@ -35,7 +35,6 @@
+ #include "wl12xx_80211.h"
+ #include "cmd.h"
+ #include "event.h"
+-#include "ps.h"
+ #include "tx.h"
+ #include "hw_ops.h"
+ 
+@@ -192,10 +191,6 @@ int wlcore_cmd_wait_for_event_or_timeout(struct wl1271 *wl,
+ 
+ 	timeout_time = jiffies + msecs_to_jiffies(WL1271_EVENT_TIMEOUT);
+ 
+-	ret = wl1271_ps_elp_wakeup(wl);
+-	if (ret < 0)
+-		return ret;
+-
+ 	do {
+ 		if (time_after(jiffies, timeout_time)) {
+ 			wl1271_debug(DEBUG_CMD, "timeout waiting for event %d",
+@@ -227,7 +222,6 @@ int wlcore_cmd_wait_for_event_or_timeout(struct wl1271 *wl,
+ 	} while (!event);
+ 
+ out:
+-	wl1271_ps_elp_sleep(wl);
+ 	kfree(events_vector);
+ 	return ret;
+ }
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index 09ac56317f1b..533bd2467910 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -4519,8 +4519,8 @@ static int qeth_snmp_command_cb(struct qeth_card *card,
+ {
+ 	struct qeth_ipa_cmd *cmd;
+ 	struct qeth_arp_query_info *qinfo;
+-	struct qeth_snmp_cmd *snmp;
+ 	unsigned char *data;
++	void *snmp_data;
+ 	__u16 data_len;
+ 
+ 	QETH_CARD_TEXT(card, 3, "snpcmdcb");
+@@ -4528,7 +4528,6 @@ static int qeth_snmp_command_cb(struct qeth_card *card,
+ 	cmd = (struct qeth_ipa_cmd *) sdata;
+ 	data = (unsigned char *)((char *)cmd - reply->offset);
+ 	qinfo = (struct qeth_arp_query_info *) reply->param;
+-	snmp = &cmd->data.setadapterparms.data.snmp;
+ 
+ 	if (cmd->hdr.return_code) {
+ 		QETH_CARD_TEXT_(card, 4, "scer1%x", cmd->hdr.return_code);
+@@ -4541,10 +4540,15 @@ static int qeth_snmp_command_cb(struct qeth_card *card,
+ 		return 0;
+ 	}
+ 	data_len = *((__u16 *)QETH_IPA_PDU_LEN_PDU1(data));
+-	if (cmd->data.setadapterparms.hdr.seq_no == 1)
+-		data_len -= (__u16)((char *)&snmp->data - (char *)cmd);
+-	else
+-		data_len -= (__u16)((char *)&snmp->request - (char *)cmd);
++	if (cmd->data.setadapterparms.hdr.seq_no == 1) {
++		snmp_data = &cmd->data.setadapterparms.data.snmp;
++		data_len -= offsetof(struct qeth_ipa_cmd,
++				     data.setadapterparms.data.snmp);
++	} else {
++		snmp_data = &cmd->data.setadapterparms.data.snmp.request;
++		data_len -= offsetof(struct qeth_ipa_cmd,
++				     data.setadapterparms.data.snmp.request);
++	}
+ 
+ 	/* check if there is enough room in userspace */
+ 	if ((qinfo->udata_len - qinfo->udata_offset) < data_len) {
+@@ -4557,16 +4561,9 @@ static int qeth_snmp_command_cb(struct qeth_card *card,
+ 	QETH_CARD_TEXT_(card, 4, "sseqn%i",
+ 		cmd->data.setadapterparms.hdr.seq_no);
+ 	/*copy entries to user buffer*/
+-	if (cmd->data.setadapterparms.hdr.seq_no == 1) {
+-		memcpy(qinfo->udata + qinfo->udata_offset,
+-		       (char *)snmp,
+-		       data_len + offsetof(struct qeth_snmp_cmd, data));
+-		qinfo->udata_offset += offsetof(struct qeth_snmp_cmd, data);
+-	} else {
+-		memcpy(qinfo->udata + qinfo->udata_offset,
+-		       (char *)&snmp->request, data_len);
+-	}
++	memcpy(qinfo->udata + qinfo->udata_offset, snmp_data, data_len);
+ 	qinfo->udata_offset += data_len;
++
+ 	/* check if all replies received ... */
+ 		QETH_CARD_TEXT_(card, 4, "srtot%i",
+ 			       cmd->data.setadapterparms.hdr.used_total);
+diff --git a/drivers/s390/virtio/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c
+index 1b831598df7c..ff06bdfd2b20 100644
+--- a/drivers/s390/virtio/virtio_ccw.c
++++ b/drivers/s390/virtio/virtio_ccw.c
+@@ -59,6 +59,7 @@ struct virtio_ccw_device {
+ 	unsigned int revision; /* Transport revision */
+ 	wait_queue_head_t wait_q;
+ 	spinlock_t lock;
++	struct mutex io_lock; /* Serializes I/O requests */
+ 	struct list_head virtqueues;
+ 	unsigned long indicators;
+ 	unsigned long indicators2;
+@@ -307,6 +308,7 @@ static int ccw_io_helper(struct virtio_ccw_device *vcdev,
+ 	unsigned long flags;
+ 	int flag = intparm & VIRTIO_CCW_INTPARM_MASK;
+ 
++	mutex_lock(&vcdev->io_lock);
+ 	do {
+ 		spin_lock_irqsave(get_ccwdev_lock(vcdev->cdev), flags);
+ 		ret = ccw_device_start(vcdev->cdev, ccw, intparm, 0, 0);
+@@ -319,7 +321,9 @@ static int ccw_io_helper(struct virtio_ccw_device *vcdev,
+ 		cpu_relax();
+ 	} while (ret == -EBUSY);
+ 	wait_event(vcdev->wait_q, doing_io(vcdev, flag) == 0);
+-	return ret ? ret : vcdev->err;
++	ret = ret ? ret : vcdev->err;
++	mutex_unlock(&vcdev->io_lock);
++	return ret;
+ }
+ 
+ static void virtio_ccw_drop_indicator(struct virtio_ccw_device *vcdev,
+@@ -833,6 +837,7 @@ static void virtio_ccw_get_config(struct virtio_device *vdev,
+ 	int ret;
+ 	struct ccw1 *ccw;
+ 	void *config_area;
++	unsigned long flags;
+ 
+ 	ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL);
+ 	if (!ccw)
+@@ -851,11 +856,13 @@ static void virtio_ccw_get_config(struct virtio_device *vdev,
+ 	if (ret)
+ 		goto out_free;
+ 
++	spin_lock_irqsave(&vcdev->lock, flags);
+ 	memcpy(vcdev->config, config_area, offset + len);
+-	if (buf)
+-		memcpy(buf, &vcdev->config[offset], len);
+ 	if (vcdev->config_ready < offset + len)
+ 		vcdev->config_ready = offset + len;
++	spin_unlock_irqrestore(&vcdev->lock, flags);
++	if (buf)
++		memcpy(buf, config_area + offset, len);
+ 
+ out_free:
+ 	kfree(config_area);
+@@ -869,6 +876,7 @@ static void virtio_ccw_set_config(struct virtio_device *vdev,
+ 	struct virtio_ccw_device *vcdev = to_vc_device(vdev);
+ 	struct ccw1 *ccw;
+ 	void *config_area;
++	unsigned long flags;
+ 
+ 	ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL);
+ 	if (!ccw)
+@@ -881,9 +889,11 @@ static void virtio_ccw_set_config(struct virtio_device *vdev,
+ 	/* Make sure we don't overwrite fields. */
+ 	if (vcdev->config_ready < offset)
+ 		virtio_ccw_get_config(vdev, 0, NULL, offset);
++	spin_lock_irqsave(&vcdev->lock, flags);
+ 	memcpy(&vcdev->config[offset], buf, len);
+ 	/* Write the config area to the host. */
+ 	memcpy(config_area, vcdev->config, sizeof(vcdev->config));
++	spin_unlock_irqrestore(&vcdev->lock, flags);
+ 	ccw->cmd_code = CCW_CMD_WRITE_CONF;
+ 	ccw->flags = 0;
+ 	ccw->count = offset + len;
+@@ -1230,6 +1240,7 @@ static int virtio_ccw_online(struct ccw_device *cdev)
+ 	init_waitqueue_head(&vcdev->wait_q);
+ 	INIT_LIST_HEAD(&vcdev->virtqueues);
+ 	spin_lock_init(&vcdev->lock);
++	mutex_init(&vcdev->io_lock);
+ 
+ 	spin_lock_irqsave(get_ccwdev_lock(cdev), flags);
+ 	dev_set_drvdata(&cdev->dev, vcdev);
+diff --git a/drivers/scsi/bfa/bfa_fcbuild.c b/drivers/scsi/bfa/bfa_fcbuild.c
+index dce787f6cca2..daade591409a 100644
+--- a/drivers/scsi/bfa/bfa_fcbuild.c
++++ b/drivers/scsi/bfa/bfa_fcbuild.c
+@@ -1249,8 +1249,8 @@ fc_rspnid_build(struct fchs_s *fchs, void *pyld, u32 s_id, u16 ox_id,
+ 	memset(rspnid, 0, sizeof(struct fcgs_rspnid_req_s));
+ 
+ 	rspnid->dap = s_id;
+-	rspnid->spn_len = (u8) strlen((char *)name);
+-	strncpy((char *)rspnid->spn, (char *)name, rspnid->spn_len);
++	strlcpy(rspnid->spn, name, sizeof(rspnid->spn));
++	rspnid->spn_len = (u8) strlen(rspnid->spn);
+ 
+ 	return sizeof(struct fcgs_rspnid_req_s) + sizeof(struct ct_hdr_s);
+ }
+@@ -1270,8 +1270,8 @@ fc_rsnn_nn_build(struct fchs_s *fchs, void *pyld, u32 s_id,
+ 	memset(rsnn_nn, 0, sizeof(struct fcgs_rsnn_nn_req_s));
+ 
+ 	rsnn_nn->node_name = node_name;
+-	rsnn_nn->snn_len = (u8) strlen((char *)name);
+-	strncpy((char *)rsnn_nn->snn, (char *)name, rsnn_nn->snn_len);
++	strlcpy(rsnn_nn->snn, name, sizeof(rsnn_nn->snn));
++	rsnn_nn->snn_len = (u8) strlen(rsnn_nn->snn);
+ 
+ 	return sizeof(struct fcgs_rsnn_nn_req_s) + sizeof(struct ct_hdr_s);
+ }
+diff --git a/drivers/scsi/bfa/bfa_fcs.c b/drivers/scsi/bfa/bfa_fcs.c
+index 0f19455951ec..475470efb7c6 100644
+--- a/drivers/scsi/bfa/bfa_fcs.c
++++ b/drivers/scsi/bfa/bfa_fcs.c
+@@ -831,23 +831,23 @@ bfa_fcs_fabric_psymb_init(struct bfa_fcs_fabric_s *fabric)
+ 	bfa_ioc_get_adapter_model(&fabric->fcs->bfa->ioc, model);
+ 
+ 	/* Model name/number */
+-	strncpy((char *)&port_cfg->sym_name, model,
+-		BFA_FCS_PORT_SYMBNAME_MODEL_SZ);
+-	strncat((char *)&port_cfg->sym_name, BFA_FCS_PORT_SYMBNAME_SEPARATOR,
+-		sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR));
++	strlcpy(port_cfg->sym_name.symname, model,
++		BFA_SYMNAME_MAXLEN);
++	strlcat(port_cfg->sym_name.symname, BFA_FCS_PORT_SYMBNAME_SEPARATOR,
++		BFA_SYMNAME_MAXLEN);
+ 
+ 	/* Driver Version */
+-	strncat((char *)&port_cfg->sym_name, (char *)driver_info->version,
+-		BFA_FCS_PORT_SYMBNAME_VERSION_SZ);
+-	strncat((char *)&port_cfg->sym_name, BFA_FCS_PORT_SYMBNAME_SEPARATOR,
+-		sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR));
++	strlcat(port_cfg->sym_name.symname, driver_info->version,
++		BFA_SYMNAME_MAXLEN);
++	strlcat(port_cfg->sym_name.symname, BFA_FCS_PORT_SYMBNAME_SEPARATOR,
++		BFA_SYMNAME_MAXLEN);
+ 
+ 	/* Host machine name */
+-	strncat((char *)&port_cfg->sym_name,
+-		(char *)driver_info->host_machine_name,
+-		BFA_FCS_PORT_SYMBNAME_MACHINENAME_SZ);
+-	strncat((char *)&port_cfg->sym_name, BFA_FCS_PORT_SYMBNAME_SEPARATOR,
+-		sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR));
++	strlcat(port_cfg->sym_name.symname,
++		driver_info->host_machine_name,
++		BFA_SYMNAME_MAXLEN);
++	strlcat(port_cfg->sym_name.symname, BFA_FCS_PORT_SYMBNAME_SEPARATOR,
++		BFA_SYMNAME_MAXLEN);
+ 
+ 	/*
+ 	 * Host OS Info :
+@@ -855,24 +855,24 @@ bfa_fcs_fabric_psymb_init(struct bfa_fcs_fabric_s *fabric)
+ 	 * OS name string and instead copy the entire OS info string (64 bytes).
+ 	 */
+ 	if (driver_info->host_os_patch[0] == '\0') {
+-		strncat((char *)&port_cfg->sym_name,
+-			(char *)driver_info->host_os_name,
+-			BFA_FCS_OS_STR_LEN);
+-		strncat((char *)&port_cfg->sym_name,
++		strlcat(port_cfg->sym_name.symname,
++			driver_info->host_os_name,
++			BFA_SYMNAME_MAXLEN);
++		strlcat(port_cfg->sym_name.symname,
+ 			BFA_FCS_PORT_SYMBNAME_SEPARATOR,
+-			sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR));
++			BFA_SYMNAME_MAXLEN);
+ 	} else {
+-		strncat((char *)&port_cfg->sym_name,
+-			(char *)driver_info->host_os_name,
+-			BFA_FCS_PORT_SYMBNAME_OSINFO_SZ);
+-		strncat((char *)&port_cfg->sym_name,
++		strlcat(port_cfg->sym_name.symname,
++			driver_info->host_os_name,
++			BFA_SYMNAME_MAXLEN);
++		strlcat(port_cfg->sym_name.symname,
+ 			BFA_FCS_PORT_SYMBNAME_SEPARATOR,
+-			sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR));
++			BFA_SYMNAME_MAXLEN);
+ 
+ 		/* Append host OS Patch Info */
+-		strncat((char *)&port_cfg->sym_name,
+-			(char *)driver_info->host_os_patch,
+-			BFA_FCS_PORT_SYMBNAME_OSPATCH_SZ);
++		strlcat(port_cfg->sym_name.symname,
++			driver_info->host_os_patch,
++			BFA_SYMNAME_MAXLEN);
+ 	}
+ 
+ 	/* null terminate */
+@@ -892,26 +892,26 @@ bfa_fcs_fabric_nsymb_init(struct bfa_fcs_fabric_s *fabric)
+ 	bfa_ioc_get_adapter_model(&fabric->fcs->bfa->ioc, model);
+ 
+ 	/* Model name/number */
+-	strncpy((char *)&port_cfg->node_sym_name, model,
+-		BFA_FCS_PORT_SYMBNAME_MODEL_SZ);
+-	strncat((char *)&port_cfg->node_sym_name,
++	strlcpy(port_cfg->node_sym_name.symname, model,
++		BFA_SYMNAME_MAXLEN);
++	strlcat(port_cfg->node_sym_name.symname,
+ 			BFA_FCS_PORT_SYMBNAME_SEPARATOR,
+-			sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR));
++			BFA_SYMNAME_MAXLEN);
+ 
+ 	/* Driver Version */
+-	strncat((char *)&port_cfg->node_sym_name, (char *)driver_info->version,
+-		BFA_FCS_PORT_SYMBNAME_VERSION_SZ);
+-	strncat((char *)&port_cfg->node_sym_name,
++	strlcat(port_cfg->node_sym_name.symname, (char *)driver_info->version,
++		BFA_SYMNAME_MAXLEN);
++	strlcat(port_cfg->node_sym_name.symname,
+ 			BFA_FCS_PORT_SYMBNAME_SEPARATOR,
+-			sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR));
++			BFA_SYMNAME_MAXLEN);
+ 
+ 	/* Host machine name */
+-	strncat((char *)&port_cfg->node_sym_name,
+-		(char *)driver_info->host_machine_name,
+-		BFA_FCS_PORT_SYMBNAME_MACHINENAME_SZ);
+-	strncat((char *)&port_cfg->node_sym_name,
++	strlcat(port_cfg->node_sym_name.symname,
++		driver_info->host_machine_name,
++		BFA_SYMNAME_MAXLEN);
++	strlcat(port_cfg->node_sym_name.symname,
+ 			BFA_FCS_PORT_SYMBNAME_SEPARATOR,
+-			sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR));
++			BFA_SYMNAME_MAXLEN);
+ 
+ 	/* null terminate */
+ 	port_cfg->node_sym_name.symname[BFA_SYMNAME_MAXLEN - 1] = 0;
+diff --git a/drivers/scsi/bfa/bfa_fcs_lport.c b/drivers/scsi/bfa/bfa_fcs_lport.c
+index ff75ef891755..aa96f31ebc43 100644
+--- a/drivers/scsi/bfa/bfa_fcs_lport.c
++++ b/drivers/scsi/bfa/bfa_fcs_lport.c
+@@ -2630,10 +2630,10 @@ bfa_fcs_fdmi_get_hbaattr(struct bfa_fcs_lport_fdmi_s *fdmi,
+ 	bfa_ioc_get_adapter_fw_ver(&port->fcs->bfa->ioc,
+ 					hba_attr->fw_version);
+ 
+-	strncpy(hba_attr->driver_version, (char *)driver_info->version,
++	strlcpy(hba_attr->driver_version, (char *)driver_info->version,
+ 		sizeof(hba_attr->driver_version));
+ 
+-	strncpy(hba_attr->os_name, driver_info->host_os_name,
++	strlcpy(hba_attr->os_name, driver_info->host_os_name,
+ 		sizeof(hba_attr->os_name));
+ 
+ 	/*
+@@ -2641,23 +2641,23 @@ bfa_fcs_fdmi_get_hbaattr(struct bfa_fcs_lport_fdmi_s *fdmi,
+ 	 * to the os name along with a separator
+ 	 */
+ 	if (driver_info->host_os_patch[0] != '\0') {
+-		strncat(hba_attr->os_name, BFA_FCS_PORT_SYMBNAME_SEPARATOR,
+-			sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR));
+-		strncat(hba_attr->os_name, driver_info->host_os_patch,
+-				sizeof(driver_info->host_os_patch));
++		strlcat(hba_attr->os_name, BFA_FCS_PORT_SYMBNAME_SEPARATOR,
++			sizeof(hba_attr->os_name));
++		strlcat(hba_attr->os_name, driver_info->host_os_patch,
++				sizeof(hba_attr->os_name));
+ 	}
+ 
+ 	/* Retrieve the max frame size from the port attr */
+ 	bfa_fcs_fdmi_get_portattr(fdmi, &fcs_port_attr);
+ 	hba_attr->max_ct_pyld = fcs_port_attr.max_frm_size;
+ 
+-	strncpy(hba_attr->node_sym_name.symname,
++	strlcpy(hba_attr->node_sym_name.symname,
+ 		port->port_cfg.node_sym_name.symname, BFA_SYMNAME_MAXLEN);
+ 	strcpy(hba_attr->vendor_info, "BROCADE");
+ 	hba_attr->num_ports =
+ 		cpu_to_be32(bfa_ioc_get_nports(&port->fcs->bfa->ioc));
+ 	hba_attr->fabric_name = port->fabric->lps->pr_nwwn;
+-	strncpy(hba_attr->bios_ver, hba_attr->option_rom_ver, BFA_VERSION_LEN);
++	strlcpy(hba_attr->bios_ver, hba_attr->option_rom_ver, BFA_VERSION_LEN);
+ 
+ }
+ 
+@@ -2724,20 +2724,20 @@ bfa_fcs_fdmi_get_portattr(struct bfa_fcs_lport_fdmi_s *fdmi,
+ 	/*
+ 	 * OS device Name
+ 	 */
+-	strncpy(port_attr->os_device_name, (char *)driver_info->os_device_name,
++	strlcpy(port_attr->os_device_name, driver_info->os_device_name,
+ 		sizeof(port_attr->os_device_name));
+ 
+ 	/*
+ 	 * Host name
+ 	 */
+-	strncpy(port_attr->host_name, (char *)driver_info->host_machine_name,
++	strlcpy(port_attr->host_name, driver_info->host_machine_name,
+ 		sizeof(port_attr->host_name));
+ 
+ 	port_attr->node_name = bfa_fcs_lport_get_nwwn(port);
+ 	port_attr->port_name = bfa_fcs_lport_get_pwwn(port);
+ 
+-	strncpy(port_attr->port_sym_name.symname,
+-		(char *)&bfa_fcs_lport_get_psym_name(port), BFA_SYMNAME_MAXLEN);
++	strlcpy(port_attr->port_sym_name.symname,
++		bfa_fcs_lport_get_psym_name(port).symname, BFA_SYMNAME_MAXLEN);
+ 	bfa_fcs_lport_get_attr(port, &lport_attr);
+ 	port_attr->port_type = cpu_to_be32(lport_attr.port_type);
+ 	port_attr->scos = pport_attr.cos_supported;
+@@ -3217,7 +3217,7 @@ bfa_fcs_lport_ms_gmal_response(void *fcsarg, struct bfa_fcxp_s *fcxp,
+ 					rsp_str[gmal_entry->len-1] = 0;
+ 
+ 				/* copy IP Address to fabric */
+-				strncpy(bfa_fcs_lport_get_fabric_ipaddr(port),
++				strlcpy(bfa_fcs_lport_get_fabric_ipaddr(port),
+ 					gmal_entry->ip_addr,
+ 					BFA_FCS_FABRIC_IPADDR_SZ);
+ 				break;
+@@ -4655,21 +4655,13 @@ bfa_fcs_lport_ns_send_rspn_id(void *ns_cbarg, struct bfa_fcxp_s *fcxp_alloced)
+ 		 * to that of the base port.
+ 		 */
+ 
+-		strncpy((char *)psymbl,
+-			(char *) &
+-			(bfa_fcs_lport_get_psym_name
++		strlcpy(symbl,
++			(char *)&(bfa_fcs_lport_get_psym_name
+ 			 (bfa_fcs_get_base_port(port->fcs))),
+-			strlen((char *) &
+-			       bfa_fcs_lport_get_psym_name(bfa_fcs_get_base_port
+-							  (port->fcs))));
+-
+-		/* Ensure we have a null terminating string. */
+-		((char *)psymbl)[strlen((char *) &
+-			bfa_fcs_lport_get_psym_name(bfa_fcs_get_base_port
+-						(port->fcs)))] = 0;
+-		strncat((char *)psymbl,
+-			(char *) &(bfa_fcs_lport_get_psym_name(port)),
+-		strlen((char *) &bfa_fcs_lport_get_psym_name(port)));
++			sizeof(symbl));
++
++		strlcat(symbl, (char *)&(bfa_fcs_lport_get_psym_name(port)),
++			sizeof(symbl));
+ 	} else {
+ 		psymbl = (u8 *) &(bfa_fcs_lport_get_psym_name(port));
+ 	}
+@@ -5161,7 +5153,6 @@ bfa_fcs_lport_ns_util_send_rspn_id(void *cbarg, struct bfa_fcxp_s *fcxp_alloced)
+ 	struct fchs_s fchs;
+ 	struct bfa_fcxp_s *fcxp;
+ 	u8 symbl[256];
+-	u8 *psymbl = &symbl[0];
+ 	int len;
+ 
+ 	/* Avoid sending RSPN in the following states. */
+@@ -5191,22 +5182,17 @@ bfa_fcs_lport_ns_util_send_rspn_id(void *cbarg, struct bfa_fcxp_s *fcxp_alloced)
+ 		 * For Vports, we append the vport's port symbolic name
+ 		 * to that of the base port.
+ 		 */
+-		strncpy((char *)psymbl, (char *)&(bfa_fcs_lport_get_psym_name
++		strlcpy(symbl, (char *)&(bfa_fcs_lport_get_psym_name
+ 			(bfa_fcs_get_base_port(port->fcs))),
+-			strlen((char *)&bfa_fcs_lport_get_psym_name(
+-			bfa_fcs_get_base_port(port->fcs))));
+-
+-		/* Ensure we have a null terminating string. */
+-		((char *)psymbl)[strlen((char *)&bfa_fcs_lport_get_psym_name(
+-		 bfa_fcs_get_base_port(port->fcs)))] = 0;
++			sizeof(symbl));
+ 
+-		strncat((char *)psymbl,
++		strlcat(symbl,
+ 			(char *)&(bfa_fcs_lport_get_psym_name(port)),
+-			strlen((char *)&bfa_fcs_lport_get_psym_name(port)));
++			sizeof(symbl));
+ 	}
+ 
+ 	len = fc_rspnid_build(&fchs, bfa_fcxp_get_reqbuf(fcxp),
+-			      bfa_fcs_lport_get_fcid(port), 0, psymbl);
++			      bfa_fcs_lport_get_fcid(port), 0, symbl);
+ 
+ 	bfa_fcxp_send(fcxp, NULL, port->fabric->vf_id, port->lp_tag, BFA_FALSE,
+ 		      FC_CLASS_3, len, &fchs, NULL, NULL, FC_MAX_PDUSZ, 0);
+diff --git a/drivers/scsi/bfa/bfa_ioc.c b/drivers/scsi/bfa/bfa_ioc.c
+index 98f7e8cca52d..e533474748a5 100644
+--- a/drivers/scsi/bfa/bfa_ioc.c
++++ b/drivers/scsi/bfa/bfa_ioc.c
+@@ -2802,7 +2802,7 @@ void
+ bfa_ioc_get_adapter_manufacturer(struct bfa_ioc_s *ioc, char *manufacturer)
+ {
+ 	memset((void *)manufacturer, 0, BFA_ADAPTER_MFG_NAME_LEN);
+-	memcpy(manufacturer, BFA_MFG_NAME, BFA_ADAPTER_MFG_NAME_LEN);
++	strlcpy(manufacturer, BFA_MFG_NAME, BFA_ADAPTER_MFG_NAME_LEN);
+ }
+ 
+ void
+diff --git a/drivers/scsi/bfa/bfa_svc.c b/drivers/scsi/bfa/bfa_svc.c
+index 625225f31081..15d02eb09476 100644
+--- a/drivers/scsi/bfa/bfa_svc.c
++++ b/drivers/scsi/bfa/bfa_svc.c
+@@ -365,8 +365,8 @@ bfa_plog_str(struct bfa_plog_s *plog, enum bfa_plog_mid mid,
+ 		lp.eid = event;
+ 		lp.log_type = BFA_PL_LOG_TYPE_STRING;
+ 		lp.misc = misc;
+-		strncpy(lp.log_entry.string_log, log_str,
+-			BFA_PL_STRING_LOG_SZ - 1);
++		strlcpy(lp.log_entry.string_log, log_str,
++			BFA_PL_STRING_LOG_SZ);
+ 		lp.log_entry.string_log[BFA_PL_STRING_LOG_SZ - 1] = '\0';
+ 		bfa_plog_add(plog, &lp);
+ 	}
+diff --git a/drivers/scsi/bfa/bfad.c b/drivers/scsi/bfa/bfad.c
+index cc3b9d3d6d40..bfefa2bfde0e 100644
+--- a/drivers/scsi/bfa/bfad.c
++++ b/drivers/scsi/bfa/bfad.c
+@@ -987,20 +987,20 @@ bfad_start_ops(struct bfad_s *bfad) {
+ 
+ 	/* Fill the driver_info info to fcs*/
+ 	memset(&driver_info, 0, sizeof(driver_info));
+-	strncpy(driver_info.version, BFAD_DRIVER_VERSION,
+-		sizeof(driver_info.version) - 1);
++	strlcpy(driver_info.version, BFAD_DRIVER_VERSION,
++		sizeof(driver_info.version));
+ 	if (host_name)
+-		strncpy(driver_info.host_machine_name, host_name,
+-			sizeof(driver_info.host_machine_name) - 1);
++		strlcpy(driver_info.host_machine_name, host_name,
++			sizeof(driver_info.host_machine_name));
+ 	if (os_name)
+-		strncpy(driver_info.host_os_name, os_name,
+-			sizeof(driver_info.host_os_name) - 1);
++		strlcpy(driver_info.host_os_name, os_name,
++			sizeof(driver_info.host_os_name));
+ 	if (os_patch)
+-		strncpy(driver_info.host_os_patch, os_patch,
+-			sizeof(driver_info.host_os_patch) - 1);
++		strlcpy(driver_info.host_os_patch, os_patch,
++			sizeof(driver_info.host_os_patch));
+ 
+-	strncpy(driver_info.os_device_name, bfad->pci_name,
+-		sizeof(driver_info.os_device_name) - 1);
++	strlcpy(driver_info.os_device_name, bfad->pci_name,
++		sizeof(driver_info.os_device_name));
+ 
+ 	/* FCS driver info init */
+ 	spin_lock_irqsave(&bfad->bfad_lock, flags);
+diff --git a/drivers/scsi/bfa/bfad_attr.c b/drivers/scsi/bfa/bfad_attr.c
+index 40be670a1cbc..6d21bc6a7713 100644
+--- a/drivers/scsi/bfa/bfad_attr.c
++++ b/drivers/scsi/bfa/bfad_attr.c
+@@ -842,7 +842,7 @@ bfad_im_symbolic_name_show(struct device *dev, struct device_attribute *attr,
+ 	char symname[BFA_SYMNAME_MAXLEN];
+ 
+ 	bfa_fcs_lport_get_attr(&bfad->bfa_fcs.fabric.bport, &port_attr);
+-	strncpy(symname, port_attr.port_cfg.sym_name.symname,
++	strlcpy(symname, port_attr.port_cfg.sym_name.symname,
+ 			BFA_SYMNAME_MAXLEN);
+ 	return snprintf(buf, PAGE_SIZE, "%s\n", symname);
+ }
+diff --git a/drivers/scsi/bfa/bfad_bsg.c b/drivers/scsi/bfa/bfad_bsg.c
+index 023b9d42ad9a..be2de04179d0 100644
+--- a/drivers/scsi/bfa/bfad_bsg.c
++++ b/drivers/scsi/bfa/bfad_bsg.c
+@@ -126,7 +126,7 @@ bfad_iocmd_ioc_get_attr(struct bfad_s *bfad, void *cmd)
+ 
+ 	/* fill in driver attr info */
+ 	strcpy(iocmd->ioc_attr.driver_attr.driver, BFAD_DRIVER_NAME);
+-	strncpy(iocmd->ioc_attr.driver_attr.driver_ver,
++	strlcpy(iocmd->ioc_attr.driver_attr.driver_ver,
+ 		BFAD_DRIVER_VERSION, BFA_VERSION_LEN);
+ 	strcpy(iocmd->ioc_attr.driver_attr.fw_ver,
+ 		iocmd->ioc_attr.adapter_attr.fw_ver);
+@@ -314,9 +314,9 @@ bfad_iocmd_port_get_attr(struct bfad_s *bfad, void *cmd)
+ 	iocmd->attr.port_type = port_attr.port_type;
+ 	iocmd->attr.loopback = port_attr.loopback;
+ 	iocmd->attr.authfail = port_attr.authfail;
+-	strncpy(iocmd->attr.port_symname.symname,
++	strlcpy(iocmd->attr.port_symname.symname,
+ 		port_attr.port_cfg.sym_name.symname,
+-		sizeof(port_attr.port_cfg.sym_name.symname));
++		sizeof(iocmd->attr.port_symname.symname));
+ 
+ 	iocmd->status = BFA_STATUS_OK;
+ 	return 0;
+diff --git a/drivers/scsi/csiostor/csio_lnode.c b/drivers/scsi/csiostor/csio_lnode.c
+index c00b2ff72b55..be5ee2d37815 100644
+--- a/drivers/scsi/csiostor/csio_lnode.c
++++ b/drivers/scsi/csiostor/csio_lnode.c
+@@ -238,14 +238,23 @@ csio_osname(uint8_t *buf, size_t buf_len)
+ }
+ 
+ static inline void
+-csio_append_attrib(uint8_t **ptr, uint16_t type, uint8_t *val, uint16_t len)
++csio_append_attrib(uint8_t **ptr, uint16_t type, void *val, size_t val_len)
+ {
++	uint16_t len;
+ 	struct fc_fdmi_attr_entry *ae = (struct fc_fdmi_attr_entry *)*ptr;
++
++	if (WARN_ON(val_len > U16_MAX))
++		return;
++
++	len = val_len;
++
+ 	ae->type = htons(type);
+ 	len += 4;		/* includes attribute type and length */
+ 	len = (len + 3) & ~3;	/* should be multiple of 4 bytes */
+ 	ae->len = htons(len);
+-	memcpy(ae->value, val, len);
++	memcpy(ae->value, val, val_len);
++	if (len > val_len)
++		memset(ae->value + val_len, 0, len - val_len);
+ 	*ptr += len;
+ }
+ 
+@@ -335,7 +344,7 @@ csio_ln_fdmi_rhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req)
+ 	numattrs++;
+ 	val = htonl(FC_PORTSPEED_1GBIT | FC_PORTSPEED_10GBIT);
+ 	csio_append_attrib(&pld, FC_FDMI_PORT_ATTR_SUPPORTEDSPEED,
+-			   (uint8_t *)&val,
++			   &val,
+ 			   FC_FDMI_PORT_ATTR_SUPPORTEDSPEED_LEN);
+ 	numattrs++;
+ 
+@@ -346,23 +355,22 @@ csio_ln_fdmi_rhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req)
+ 	else
+ 		val = htonl(CSIO_HBA_PORTSPEED_UNKNOWN);
+ 	csio_append_attrib(&pld, FC_FDMI_PORT_ATTR_CURRENTPORTSPEED,
+-			   (uint8_t *)&val,
+-			   FC_FDMI_PORT_ATTR_CURRENTPORTSPEED_LEN);
++			   &val, FC_FDMI_PORT_ATTR_CURRENTPORTSPEED_LEN);
+ 	numattrs++;
+ 
+ 	mfs = ln->ln_sparm.csp.sp_bb_data;
+ 	csio_append_attrib(&pld, FC_FDMI_PORT_ATTR_MAXFRAMESIZE,
+-			   (uint8_t *)&mfs, FC_FDMI_PORT_ATTR_MAXFRAMESIZE_LEN);
++			   &mfs, sizeof(mfs));
+ 	numattrs++;
+ 
+ 	strcpy(buf, "csiostor");
+ 	csio_append_attrib(&pld, FC_FDMI_PORT_ATTR_OSDEVICENAME, buf,
+-			   (uint16_t)strlen(buf));
++			   strlen(buf));
+ 	numattrs++;
+ 
+ 	if (!csio_hostname(buf, sizeof(buf))) {
+ 		csio_append_attrib(&pld, FC_FDMI_PORT_ATTR_HOSTNAME,
+-				   buf, (uint16_t)strlen(buf));
++				   buf, strlen(buf));
+ 		numattrs++;
+ 	}
+ 	attrib_blk->numattrs = htonl(numattrs);
+@@ -444,33 +452,32 @@ csio_ln_fdmi_dprt_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req)
+ 
+ 	strcpy(buf, "Chelsio Communications");
+ 	csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_MANUFACTURER, buf,
+-			   (uint16_t)strlen(buf));
++			   strlen(buf));
+ 	numattrs++;
+ 	csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_SERIALNUMBER,
+-			   hw->vpd.sn, (uint16_t)sizeof(hw->vpd.sn));
++			   hw->vpd.sn, sizeof(hw->vpd.sn));
+ 	numattrs++;
+ 	csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_MODEL, hw->vpd.id,
+-			   (uint16_t)sizeof(hw->vpd.id));
++			   sizeof(hw->vpd.id));
+ 	numattrs++;
+ 	csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_MODELDESCRIPTION,
+-			   hw->model_desc, (uint16_t)strlen(hw->model_desc));
++			   hw->model_desc, strlen(hw->model_desc));
+ 	numattrs++;
+ 	csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_HARDWAREVERSION,
+-			   hw->hw_ver, (uint16_t)sizeof(hw->hw_ver));
++			   hw->hw_ver, sizeof(hw->hw_ver));
+ 	numattrs++;
+ 	csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_FIRMWAREVERSION,
+-			   hw->fwrev_str, (uint16_t)strlen(hw->fwrev_str));
++			   hw->fwrev_str, strlen(hw->fwrev_str));
+ 	numattrs++;
+ 
+ 	if (!csio_osname(buf, sizeof(buf))) {
+ 		csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_OSNAMEVERSION,
+-				   buf, (uint16_t)strlen(buf));
++				   buf, strlen(buf));
+ 		numattrs++;
+ 	}
+ 
+ 	csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_MAXCTPAYLOAD,
+-			   (uint8_t *)&maxpayload,
+-			   FC_FDMI_HBA_ATTR_MAXCTPAYLOAD_LEN);
++			   &maxpayload, FC_FDMI_HBA_ATTR_MAXCTPAYLOAD_LEN);
+ 	len = (uint32_t)(pld - (uint8_t *)cmd);
+ 	numattrs++;
+ 	attrib_blk->numattrs = htonl(numattrs);
+@@ -1794,6 +1801,8 @@ csio_ln_mgmt_submit_req(struct csio_ioreq *io_req,
+ 	struct csio_mgmtm *mgmtm = csio_hw_to_mgmtm(hw);
+ 	int rv;
+ 
++	BUG_ON(pld_len > pld->len);
++
+ 	io_req->io_cbfn = io_cbfn;	/* Upper layer callback handler */
+ 	io_req->fw_handle = (uintptr_t) (io_req);
+ 	io_req->eq_idx = mgmtm->eq_idx;
+diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
+index 6b61b09b3226..75f2179860a7 100644
+--- a/drivers/scsi/scsi_devinfo.c
++++ b/drivers/scsi/scsi_devinfo.c
+@@ -33,7 +33,6 @@ struct scsi_dev_info_list_table {
+ };
+ 
+ 
+-static const char spaces[] = "                "; /* 16 of them */
+ static unsigned scsi_default_dev_flags;
+ static LIST_HEAD(scsi_dev_info_list);
+ static char scsi_dev_flags[256];
+@@ -291,20 +290,13 @@ static void scsi_strcpy_devinfo(char *name, char *to, size_t to_length,
+ 	size_t from_length;
+ 
+ 	from_length = strlen(from);
+-	strncpy(to, from, min(to_length, from_length));
+-	if (from_length < to_length) {
+-		if (compatible) {
+-			/*
+-			 * NUL terminate the string if it is short.
+-			 */
+-			to[from_length] = '\0';
+-		} else {
+-			/* 
+-			 * space pad the string if it is short. 
+-			 */
+-			strncpy(&to[from_length], spaces,
+-				to_length - from_length);
+-		}
++	/* this zero-pads the destination */
++	strncpy(to, from, to_length);
++	if (from_length < to_length && !compatible) {
++		/*
++		 * space pad the string if it is short.
++		 */
++		memset(&to[from_length], ' ', to_length - from_length);
+ 	}
+ 	if (from_length > to_length)
+ 		 printk(KERN_WARNING "%s: %s string '%s' is too long\n",
+diff --git a/drivers/staging/lustre/lustre/lmv/lmv_obd.c b/drivers/staging/lustre/lustre/lmv/lmv_obd.c
+index 635a93cc94de..eed7603db5ec 100644
+--- a/drivers/staging/lustre/lustre/lmv/lmv_obd.c
++++ b/drivers/staging/lustre/lustre/lmv/lmv_obd.c
+@@ -700,7 +700,7 @@ repeat_fid2path:
+ 		memmove(ptr + strlen(gf->gf_path) + 1, ptr,
+ 			strlen(ori_gf->gf_path));
+ 
+-		strncpy(ptr, gf->gf_path, strlen(gf->gf_path));
++		strcpy(ptr, gf->gf_path);
+ 		ptr += strlen(gf->gf_path);
+ 		*ptr = '/';
+ 	}
+diff --git a/drivers/staging/rts5208/sd.c b/drivers/staging/rts5208/sd.c
+index 9a876ce92dbd..dc91cd29f1d2 100644
+--- a/drivers/staging/rts5208/sd.c
++++ b/drivers/staging/rts5208/sd.c
+@@ -4165,12 +4165,6 @@ RTY_SEND_CMD:
+ 					rtsx_trace(chip);
+ 					return STATUS_FAIL;
+ 				}
+-
+-			} else if (rsp_type == SD_RSP_TYPE_R0) {
+-				if ((ptr[3] & 0x1E) != 0x03) {
+-					rtsx_trace(chip);
+-					return STATUS_FAIL;
+-				}
+ 			}
+ 		}
+ 	}
+diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c
+index 78883ca64ddd..035810bbcd02 100644
+--- a/drivers/tty/serial/8250/8250_mtk.c
++++ b/drivers/tty/serial/8250/8250_mtk.c
+@@ -231,17 +231,17 @@ static int mtk8250_probe(struct platform_device *pdev)
+ 
+ 	platform_set_drvdata(pdev, data);
+ 
+-	pm_runtime_enable(&pdev->dev);
+-	if (!pm_runtime_enabled(&pdev->dev)) {
+-		err = mtk8250_runtime_resume(&pdev->dev);
+-		if (err)
+-			return err;
+-	}
++	err = mtk8250_runtime_resume(&pdev->dev);
++	if (err)
++		return err;
+ 
+ 	data->line = serial8250_register_8250_port(&uart);
+ 	if (data->line < 0)
+ 		return data->line;
+ 
++	pm_runtime_set_active(&pdev->dev);
++	pm_runtime_enable(&pdev->dev);
++
+ 	return 0;
+ }
+ 
+@@ -252,13 +252,11 @@ static int mtk8250_remove(struct platform_device *pdev)
+ 	pm_runtime_get_sync(&pdev->dev);
+ 
+ 	serial8250_unregister_port(data->line);
++	mtk8250_runtime_suspend(&pdev->dev);
+ 
+ 	pm_runtime_disable(&pdev->dev);
+ 	pm_runtime_put_noidle(&pdev->dev);
+ 
+-	if (!pm_runtime_status_suspended(&pdev->dev))
+-		mtk8250_runtime_suspend(&pdev->dev);
+-
+ 	return 0;
+ }
+ 
+diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c
+index 2db68dfe497d..f2b0d8cee8ef 100644
+--- a/drivers/tty/serial/kgdboc.c
++++ b/drivers/tty/serial/kgdboc.c
+@@ -131,24 +131,6 @@ static void kgdboc_unregister_kbd(void)
+ #define kgdboc_restore_input()
+ #endif /* ! CONFIG_KDB_KEYBOARD */
+ 
+-static int kgdboc_option_setup(char *opt)
+-{
+-	if (!opt) {
+-		pr_err("kgdboc: config string not provided\n");
+-		return -EINVAL;
+-	}
+-
+-	if (strlen(opt) >= MAX_CONFIG_LEN) {
+-		printk(KERN_ERR "kgdboc: config string too long\n");
+-		return -ENOSPC;
+-	}
+-	strcpy(config, opt);
+-
+-	return 0;
+-}
+-
+-__setup("kgdboc=", kgdboc_option_setup);
+-
+ static void cleanup_kgdboc(void)
+ {
+ 	if (kgdb_unregister_nmi_console())
+@@ -162,15 +144,13 @@ static int configure_kgdboc(void)
+ {
+ 	struct tty_driver *p;
+ 	int tty_line = 0;
+-	int err;
++	int err = -ENODEV;
+ 	char *cptr = config;
+ 	struct console *cons;
+ 
+-	err = kgdboc_option_setup(config);
+-	if (err || !strlen(config) || isspace(config[0]))
++	if (!strlen(config) || isspace(config[0]))
+ 		goto noconfig;
+ 
+-	err = -ENODEV;
+ 	kgdboc_io_ops.is_console = 0;
+ 	kgdb_tty_driver = NULL;
+ 
+@@ -252,7 +232,7 @@ static void kgdboc_put_char(u8 chr)
+ 
+ static int param_set_kgdboc_var(const char *kmessage, struct kernel_param *kp)
+ {
+-	int len = strlen(kmessage);
++	size_t len = strlen(kmessage);
+ 
+ 	if (len >= MAX_CONFIG_LEN) {
+ 		printk(KERN_ERR "kgdboc: config string too long\n");
+@@ -274,7 +254,7 @@ static int param_set_kgdboc_var(const char *kmessage, struct kernel_param *kp)
+ 
+ 	strcpy(config, kmessage);
+ 	/* Chop out \n char as a result of echo */
+-	if (config[len - 1] == '\n')
++	if (len && config[len - 1] == '\n')
+ 		config[len - 1] = '\0';
+ 
+ 	if (configured == 1)
+@@ -318,6 +298,25 @@ static struct kgdb_io kgdboc_io_ops = {
+ };
+ 
+ #ifdef CONFIG_KGDB_SERIAL_CONSOLE
++static int kgdboc_option_setup(char *opt)
++{
++	if (!opt) {
++		pr_err("config string not provided\n");
++		return -EINVAL;
++	}
++
++	if (strlen(opt) >= MAX_CONFIG_LEN) {
++		pr_err("config string too long\n");
++		return -ENOSPC;
++	}
++	strcpy(config, opt);
++
++	return 0;
++}
++
++__setup("kgdboc=", kgdboc_option_setup);
++
++
+ /* This is only available if kgdboc is a built in for early debugging */
+ static int __init kgdboc_early_init(char *opt)
+ {
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index f7af730aae82..be63db142d3f 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2211,7 +2211,7 @@ static int usb_enumerate_device_otg(struct usb_device *udev)
+ 		/* descriptor may appear anywhere in config */
+ 		err = __usb_get_extra_descriptor(udev->rawdescriptors[0],
+ 				le16_to_cpu(udev->config[0].desc.wTotalLength),
+-				USB_DT_OTG, (void **) &desc);
++				USB_DT_OTG, (void **) &desc, sizeof(*desc));
+ 		if (err || !(desc->bmAttributes & USB_OTG_HNP))
+ 			return 0;
+ 
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 1e8f68960014..cf378b1ed373 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -64,6 +64,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	/* Microsoft LifeCam-VX700 v2.0 */
+ 	{ USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
++	/* Cherry Stream G230 2.0 (G85-231) and 3.0 (G85-232) */
++	{ USB_DEVICE(0x046a, 0x0023), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ 	/* Logitech HD Pro Webcams C920, C920-C, C925e and C930e */
+ 	{ USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
+ 	{ USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT },
+@@ -185,6 +188,10 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	/* Midiman M-Audio Keystation 88es */
+ 	{ USB_DEVICE(0x0763, 0x0192), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
++	/* SanDisk Ultra Fit and Ultra Flair */
++	{ USB_DEVICE(0x0781, 0x5583), .driver_info = USB_QUIRK_NO_LPM },
++	{ USB_DEVICE(0x0781, 0x5591), .driver_info = USB_QUIRK_NO_LPM },
++
+ 	/* M-Systems Flash Disk Pioneers */
+ 	{ USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
+diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
+index ad308c8e9af5..36e5098e4e6f 100644
+--- a/drivers/usb/core/usb.c
++++ b/drivers/usb/core/usb.c
+@@ -678,14 +678,14 @@ EXPORT_SYMBOL_GPL(usb_get_current_frame_number);
+  */
+ 
+ int __usb_get_extra_descriptor(char *buffer, unsigned size,
+-			       unsigned char type, void **ptr)
++			       unsigned char type, void **ptr, size_t minsize)
+ {
+ 	struct usb_descriptor_header *header;
+ 
+ 	while (size >= sizeof(struct usb_descriptor_header)) {
+ 		header = (struct usb_descriptor_header *)buffer;
+ 
+-		if (header->bLength < 2) {
++		if (header->bLength < 2 || header->bLength > size) {
+ 			printk(KERN_ERR
+ 				"%s: bogus descriptor, type %d length %d\n",
+ 				usbcore_name,
+@@ -694,7 +694,7 @@ int __usb_get_extra_descriptor(char *buffer, unsigned size,
+ 			return -1;
+ 		}
+ 
+-		if (header->bDescriptorType == type) {
++		if (header->bDescriptorType == type && header->bLength >= minsize) {
+ 			*ptr = header;
+ 			return 0;
+ 		}
+diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
+index eb876ed96861..85f1f282c1d5 100644
+--- a/drivers/usb/gadget/udc/dummy_hcd.c
++++ b/drivers/usb/gadget/udc/dummy_hcd.c
+@@ -379,11 +379,10 @@ static void set_link_state_by_speed(struct dummy_hcd *dum_hcd)
+ 			     USB_PORT_STAT_CONNECTION) == 0)
+ 				dum_hcd->port_status |=
+ 					(USB_PORT_STAT_C_CONNECTION << 16);
+-			if ((dum_hcd->port_status &
+-			     USB_PORT_STAT_ENABLE) == 1 &&
+-				(dum_hcd->port_status &
+-				 USB_SS_PORT_LS_U0) == 1 &&
+-				dum_hcd->rh_state != DUMMY_RH_SUSPENDED)
++			if ((dum_hcd->port_status & USB_PORT_STAT_ENABLE) &&
++			    (dum_hcd->port_status &
++			     USB_PORT_STAT_LINK_STATE) == USB_SS_PORT_LS_U0 &&
++			    dum_hcd->rh_state != DUMMY_RH_SUSPENDED)
+ 				dum_hcd->active = 1;
+ 		}
+ 	} else {
+diff --git a/drivers/usb/host/hwa-hc.c b/drivers/usb/host/hwa-hc.c
+index 1db0626c8bf4..97750f162f01 100644
+--- a/drivers/usb/host/hwa-hc.c
++++ b/drivers/usb/host/hwa-hc.c
+@@ -654,7 +654,7 @@ static int hwahc_security_create(struct hwahc *hwahc)
+ 	top = itr + itr_size;
+ 	result = __usb_get_extra_descriptor(usb_dev->rawdescriptors[index],
+ 			le16_to_cpu(usb_dev->actconfig->desc.wTotalLength),
+-			USB_DT_SECURITY, (void **) &secd);
++			USB_DT_SECURITY, (void **) &secd, sizeof(*secd));
+ 	if (result == -1) {
+ 		dev_warn(dev, "BUG? WUSB host has no security descriptors\n");
+ 		return 0;
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 9dbf1583bd7a..e3fdc799ad6e 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -4417,6 +4417,14 @@ static u16 xhci_calculate_u1_timeout(struct xhci_hcd *xhci,
+ {
+ 	unsigned long long timeout_ns;
+ 
++	/* Prevent U1 if service interval is shorter than U1 exit latency */
++	if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) {
++		if (xhci_service_interval_to_ns(desc) <= udev->u1_params.mel) {
++			dev_dbg(&udev->dev, "Disable U1, ESIT shorter than exit latency\n");
++			return USB3_LPM_DISABLED;
++		}
++	}
++
+ 	if (xhci->quirks & XHCI_INTEL_HOST)
+ 		timeout_ns = xhci_calculate_intel_u1_timeout(udev, desc);
+ 	else
+@@ -4473,6 +4481,14 @@ static u16 xhci_calculate_u2_timeout(struct xhci_hcd *xhci,
+ {
+ 	unsigned long long timeout_ns;
+ 
++	/* Prevent U2 if service interval is shorter than U2 exit latency */
++	if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) {
++		if (xhci_service_interval_to_ns(desc) <= udev->u2_params.mel) {
++			dev_dbg(&udev->dev, "Disable U2, ESIT shorter than exit latency\n");
++			return USB3_LPM_DISABLED;
++		}
++	}
++
+ 	if (xhci->quirks & XHCI_INTEL_HOST)
+ 		timeout_ns = xhci_calculate_intel_u2_timeout(udev, desc);
+ 	else
+diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
+index b15842c6f916..993f4da065c3 100644
+--- a/drivers/usb/misc/appledisplay.c
++++ b/drivers/usb/misc/appledisplay.c
+@@ -64,6 +64,7 @@ static const struct usb_device_id appledisplay_table[] = {
+ 	{ APPLEDISPLAY_DEVICE(0x921c) },
+ 	{ APPLEDISPLAY_DEVICE(0x921d) },
+ 	{ APPLEDISPLAY_DEVICE(0x9222) },
++	{ APPLEDISPLAY_DEVICE(0x9226) },
+ 	{ APPLEDISPLAY_DEVICE(0x9236) },
+ 
+ 	/* Terminating entry */
+diff --git a/drivers/usb/storage/unusual_realtek.h b/drivers/usb/storage/unusual_realtek.h
+index e41f50c95ed4..f5fc3271e19c 100644
+--- a/drivers/usb/storage/unusual_realtek.h
++++ b/drivers/usb/storage/unusual_realtek.h
+@@ -38,4 +38,14 @@ UNUSUAL_DEV(0x0bda, 0x0159, 0x0000, 0x9999,
+ 		"USB Card Reader",
+ 		USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0),
+ 
++UNUSUAL_DEV(0x0bda, 0x0177, 0x0000, 0x9999,
++		"Realtek",
++		"USB Card Reader",
++		USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0),
++
++UNUSUAL_DEV(0x0bda, 0x0184, 0x0000, 0x9999,
++		"Realtek",
++		"USB Card Reader",
++		USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0),
++
+ #endif  /* defined(CONFIG_USB_STORAGE_REALTEK) || ... */
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index b0875ef48522..1f21c6c33228 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -445,9 +445,9 @@ static int btree_read_extent_buffer_pages(struct btrfs_root *root,
+ 	int mirror_num = 0;
+ 	int failed_mirror = 0;
+ 
+-	clear_bit(EXTENT_BUFFER_CORRUPT, &eb->bflags);
+ 	io_tree = &BTRFS_I(root->fs_info->btree_inode)->io_tree;
+ 	while (1) {
++		clear_bit(EXTENT_BUFFER_CORRUPT, &eb->bflags);
+ 		ret = read_extent_buffer_pages(io_tree, eb, start,
+ 					       WAIT_COMPLETE,
+ 					       btree_get_extent, mirror_num);
+@@ -459,14 +459,6 @@ static int btree_read_extent_buffer_pages(struct btrfs_root *root,
+ 				ret = -EIO;
+ 		}
+ 
+-		/*
+-		 * This buffer's crc is fine, but its contents are corrupted, so
+-		 * there is no reason to read the other copies, they won't be
+-		 * any less wrong.
+-		 */
+-		if (test_bit(EXTENT_BUFFER_CORRUPT, &eb->bflags))
+-			break;
+-
+ 		num_copies = btrfs_num_copies(root->fs_info,
+ 					      eb->start, eb->len);
+ 		if (num_copies == 1)
+diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
+index 1aa897dd9ce3..6c0161284a9e 100644
+--- a/fs/btrfs/free-space-cache.c
++++ b/fs/btrfs/free-space-cache.c
+@@ -2469,6 +2469,7 @@ void btrfs_dump_free_space(struct btrfs_block_group_cache *block_group,
+ 	struct rb_node *n;
+ 	int count = 0;
+ 
++	spin_lock(&ctl->tree_lock);
+ 	for (n = rb_first(&ctl->free_space_offset); n; n = rb_next(n)) {
+ 		info = rb_entry(n, struct btrfs_free_space, offset_index);
+ 		if (info->bytes >= bytes && !block_group->ro)
+@@ -2478,6 +2479,7 @@ void btrfs_dump_free_space(struct btrfs_block_group_cache *block_group,
+ 			   info->offset, info->bytes,
+ 		       (info->bitmap) ? "yes" : "no");
+ 	}
++	spin_unlock(&ctl->tree_lock);
+ 	btrfs_info(block_group->fs_info, "block group has cluster?: %s",
+ 	       list_empty(&block_group->cluster_list) ? "no" : "yes");
+ 	btrfs_info(block_group->fs_info,
+diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
+index 3bd2233737ac..0f99336c37eb 100644
+--- a/fs/btrfs/super.c
++++ b/fs/btrfs/super.c
+@@ -2104,6 +2104,7 @@ static long btrfs_control_ioctl(struct file *file, unsigned int cmd,
+ 	vol = memdup_user((void __user *)arg, sizeof(*vol));
+ 	if (IS_ERR(vol))
+ 		return PTR_ERR(vol);
++	vol->name[BTRFS_PATH_NAME_MAX] = '\0';
+ 
+ 	switch (cmd) {
+ 	case BTRFS_IOC_SCAN_DEV:
+diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
+index be8eae80ff65..098016338f98 100644
+--- a/fs/btrfs/transaction.c
++++ b/fs/btrfs/transaction.c
+@@ -1821,6 +1821,9 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
+ 		return ret;
+ 	}
+ 
++	btrfs_trans_release_metadata(trans, root);
++	trans->block_rsv = NULL;
++
+ 	/* make a pass through all the delayed refs we have so far
+ 	 * any runnings procs may add more while we are here
+ 	 */
+@@ -1830,9 +1833,6 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
+ 		return ret;
+ 	}
+ 
+-	btrfs_trans_release_metadata(trans, root);
+-	trans->block_rsv = NULL;
+-
+ 	cur_trans = trans->transaction;
+ 
+ 	/*
+diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
+index 76dacd5307b9..afd317eb9db9 100644
+--- a/fs/cifs/dir.c
++++ b/fs/cifs/dir.c
+@@ -163,7 +163,7 @@ cifs_bp_rename_retry:
+ 
+ 		cifs_dbg(FYI, "using cifs_sb prepath <%s>\n", cifs_sb->prepath);
+ 		memcpy(full_path+dfsplen+1, cifs_sb->prepath, pplen-1);
+-		full_path[dfsplen] = '\\';
++		full_path[dfsplen] = dirsep;
+ 		for (i = 0; i < pplen-1; i++)
+ 			if (full_path[dfsplen+1+i] == '/')
+ 				full_path[dfsplen+1+i] = CIFS_DIR_SEP(cifs_sb);
+diff --git a/fs/exec.c b/fs/exec.c
+index 9c5ee2a880aa..910fc70c4542 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1077,15 +1077,14 @@ killed:
+ 	return -EAGAIN;
+ }
+ 
+-char *get_task_comm(char *buf, struct task_struct *tsk)
++char *__get_task_comm(char *buf, size_t buf_size, struct task_struct *tsk)
+ {
+-	/* buf must be at least sizeof(tsk->comm) in size */
+ 	task_lock(tsk);
+-	strncpy(buf, tsk->comm, sizeof(tsk->comm));
++	strncpy(buf, tsk->comm, buf_size);
+ 	task_unlock(tsk);
+ 	return buf;
+ }
+-EXPORT_SYMBOL_GPL(get_task_comm);
++EXPORT_SYMBOL_GPL(__get_task_comm);
+ 
+ /*
+  * These functions flushes out all traces of the currently running executable
+diff --git a/fs/ext2/xattr.c b/fs/ext2/xattr.c
+index fa70848afa8f..22d817dc821e 100644
+--- a/fs/ext2/xattr.c
++++ b/fs/ext2/xattr.c
+@@ -605,9 +605,9 @@ skip_replace:
+ 	}
+ 
+ cleanup:
+-	brelse(bh);
+ 	if (!(bh && header == HDR(bh)))
+ 		kfree(header);
++	brelse(bh);
+ 	up_write(&EXT2_I(inode)->xattr_sem);
+ 
+ 	return error;
+diff --git a/fs/kernfs/symlink.c b/fs/kernfs/symlink.c
+index db272528ab5b..b3b293e2c099 100644
+--- a/fs/kernfs/symlink.c
++++ b/fs/kernfs/symlink.c
+@@ -88,7 +88,7 @@ static int kernfs_get_target_path(struct kernfs_node *parent,
+ 		int slen = strlen(kn->name);
+ 
+ 		len -= slen;
+-		strncpy(s + len, kn->name, slen);
++		memcpy(s + len, kn->name, slen);
+ 		if (len)
+ 			s[--len] = '/';
+ 
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index b30540d6d125..48a59f731406 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -2668,7 +2668,12 @@ static inline void set_task_comm(struct task_struct *tsk, const char *from)
+ {
+ 	__set_task_comm(tsk, from, false);
+ }
+-extern char *get_task_comm(char *to, struct task_struct *tsk);
++
++extern char *__get_task_comm(char *to, size_t len, struct task_struct *tsk);
++#define get_task_comm(buf, tsk) ({			\
++	BUILD_BUG_ON(sizeof(buf) != TASK_COMM_LEN);	\
++	__get_task_comm(buf, sizeof(buf), tsk);		\
++})
+ 
+ #ifdef CONFIG_SMP
+ void scheduler_ipi(void);
+diff --git a/include/linux/usb.h b/include/linux/usb.h
+index 092b5658b9c3..5c03ebc6dfa0 100644
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -334,11 +334,11 @@ struct usb_host_bos {
+ };
+ 
+ int __usb_get_extra_descriptor(char *buffer, unsigned size,
+-	unsigned char type, void **ptr);
++	unsigned char type, void **ptr, size_t min);
+ #define usb_get_extra_descriptor(ifpoint, type, ptr) \
+ 				__usb_get_extra_descriptor((ifpoint)->extra, \
+ 				(ifpoint)->extralen, \
+-				type, (void **)ptr)
++				type, (void **)ptr, sizeof(**(ptr)))
+ 
+ /* ----------------------------------------------------------------------- */
+ 
+diff --git a/include/sound/pcm_params.h b/include/sound/pcm_params.h
+index c704357775fc..2af7bb3ee57d 100644
+--- a/include/sound/pcm_params.h
++++ b/include/sound/pcm_params.h
+@@ -247,11 +247,13 @@ static inline int snd_interval_empty(const struct snd_interval *i)
+ static inline int snd_interval_single(const struct snd_interval *i)
+ {
+ 	return (i->min == i->max || 
+-		(i->min + 1 == i->max && i->openmax));
++		(i->min + 1 == i->max && (i->openmin || i->openmax)));
+ }
+ 
+ static inline int snd_interval_value(const struct snd_interval *i)
+ {
++	if (i->openmin && !i->openmax)
++		return i->max;
+ 	return i->min;
+ }
+ 
+diff --git a/kernel/debug/kdb/kdb_support.c b/kernel/debug/kdb/kdb_support.c
+index 2aed4a33521b..61cd704a21c8 100644
+--- a/kernel/debug/kdb/kdb_support.c
++++ b/kernel/debug/kdb/kdb_support.c
+@@ -129,13 +129,13 @@ int kdbnearsym(unsigned long addr, kdb_symtab_t *symtab)
+ 		}
+ 		if (i >= ARRAY_SIZE(kdb_name_table)) {
+ 			debug_kfree(kdb_name_table[0]);
+-			memcpy(kdb_name_table, kdb_name_table+1,
++			memmove(kdb_name_table, kdb_name_table+1,
+ 			       sizeof(kdb_name_table[0]) *
+ 			       (ARRAY_SIZE(kdb_name_table)-1));
+ 		} else {
+ 			debug_kfree(knt1);
+ 			knt1 = kdb_name_table[i];
+-			memcpy(kdb_name_table+i, kdb_name_table+i+1,
++			memmove(kdb_name_table+i, kdb_name_table+i+1,
+ 			       sizeof(kdb_name_table[0]) *
+ 			       (ARRAY_SIZE(kdb_name_table)-i-1));
+ 		}
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index da0c09ff6112..7108097fa2f2 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -606,7 +606,7 @@ static int prepare_uprobe(struct uprobe *uprobe, struct file *file,
+ 	BUG_ON((uprobe->offset & ~PAGE_MASK) +
+ 			UPROBE_SWBP_INSN_SIZE > PAGE_SIZE);
+ 
+-	smp_wmb(); /* pairs with rmb() in find_active_uprobe() */
++	smp_wmb(); /* pairs with the smp_rmb() in handle_swbp() */
+ 	set_bit(UPROBE_COPY_INSN, &uprobe->flags);
+ 
+  out:
+@@ -1892,10 +1892,18 @@ static void handle_swbp(struct pt_regs *regs)
+ 	 * After we hit the bp, _unregister + _register can install the
+ 	 * new and not-yet-analyzed uprobe at the same address, restart.
+ 	 */
+-	smp_rmb(); /* pairs with wmb() in install_breakpoint() */
+ 	if (unlikely(!test_bit(UPROBE_COPY_INSN, &uprobe->flags)))
+ 		goto out;
+ 
++	/*
++	 * Pairs with the smp_wmb() in prepare_uprobe().
++	 *
++	 * Guarantees that if we see the UPROBE_COPY_INSN bit set, then
++	 * we must also see the stores to &uprobe->arch performed by the
++	 * prepare_uprobe() call.
++	 */
++	smp_rmb();
++
+ 	/* Tracing handlers use ->utask to communicate with fetch methods */
+ 	if (!get_utask())
+ 		goto out;
+diff --git a/lib/kobject.c b/lib/kobject.c
+index 895edb63fba4..35d490b02cdd 100644
+--- a/lib/kobject.c
++++ b/lib/kobject.c
+@@ -127,7 +127,7 @@ static void fill_kobj_path(struct kobject *kobj, char *path, int length)
+ 		int cur = strlen(kobject_name(parent));
+ 		/* back up enough to print this name with '/' */
+ 		length -= cur;
+-		strncpy(path + length, kobject_name(parent), cur);
++		memcpy(path + length, kobject_name(parent), cur);
+ 		*(path + --length) = '/';
+ 	}
+ 
+diff --git a/mm/mlock.c b/mm/mlock.c
+index 9d2e773f3a95..b03f160c1bdd 100644
+--- a/mm/mlock.c
++++ b/mm/mlock.c
+@@ -504,6 +504,7 @@ static int mlock_fixup(struct vm_area_struct *vma, struct vm_area_struct **prev,
+ 	int nr_pages;
+ 	int ret = 0;
+ 	int lock = !!(newflags & VM_LOCKED);
++	vm_flags_t old_flags = vma->vm_flags;
+ 
+ 	if (newflags == vma->vm_flags || (vma->vm_flags & VM_SPECIAL) ||
+ 	    is_vm_hugetlb_page(vma) || vma == get_gate_vma(current->mm))
+@@ -538,6 +539,8 @@ success:
+ 	nr_pages = (end - start) >> PAGE_SHIFT;
+ 	if (!lock)
+ 		nr_pages = -nr_pages;
++	else if (old_flags & VM_LOCKED)
++		nr_pages = 0;
+ 	mm->locked_vm += nr_pages;
+ 
+ 	/*
+diff --git a/mm/truncate.c b/mm/truncate.c
+index f4c8270f7b84..aeb1adba329e 100644
+--- a/mm/truncate.c
++++ b/mm/truncate.c
+@@ -432,9 +432,13 @@ void truncate_inode_pages_final(struct address_space *mapping)
+ 		 */
+ 		spin_lock_irq(&mapping->tree_lock);
+ 		spin_unlock_irq(&mapping->tree_lock);
+-
+-		truncate_inode_pages(mapping, 0);
+ 	}
++
++	/*
++	 * Cleancache needs notification even if there are no pages or shadow
++	 * entries.
++	 */
++	truncate_inode_pages(mapping, 0);
+ }
+ EXPORT_SYMBOL(truncate_inode_pages_final);
+ 
+diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
+index 5d2f9d4879b2..d50c3b003dc9 100644
+--- a/net/batman-adv/fragmentation.c
++++ b/net/batman-adv/fragmentation.c
+@@ -266,7 +266,7 @@ batadv_frag_merge_packets(struct hlist_head *chain)
+ 	kfree(entry);
+ 
+ 	packet = (struct batadv_frag_packet *)skb_out->data;
+-	size = ntohs(packet->total_size);
++	size = ntohs(packet->total_size) + hdr_size;
+ 
+ 	/* Make room for the rest of the fragments. */
+ 	if (pskb_expand_head(skb_out, 0, size - skb_out->len, GFP_ATOMIC) < 0) {
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index 9d3176b080a4..91ae061d46ac 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -261,8 +261,8 @@ static struct net_device *__ip_tunnel_create(struct net *net,
+ 	} else {
+ 		if (strlen(ops->kind) > (IFNAMSIZ - 3))
+ 			goto failed;
+-		strlcpy(name, ops->kind, IFNAMSIZ);
+-		strncat(name, "%d", 2);
++		strcpy(name, ops->kind);
++		strcat(name, "%d");
+ 	}
+ 
+ 	ASSERT_RTNL();
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index 58588a610b05..519def0e15f1 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -987,6 +987,8 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
+ 	if (local->open_count == 0)
+ 		ieee80211_clear_tx_pending(local);
+ 
++	sdata->vif.bss_conf.beacon_int = 0;
++
+ 	/*
+ 	 * If the interface goes down while suspended, presumably because
+ 	 * the device was unplugged and that happens before our resume,
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index f8406c37fc1d..64f76f88f819 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1109,6 +1109,7 @@ ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx)
+ 		return RX_CONTINUE;
+ 
+ 	if (ieee80211_is_ctl(hdr->frame_control) ||
++	    ieee80211_is_nullfunc(hdr->frame_control) ||
+ 	    ieee80211_is_qos_nullfunc(hdr->frame_control) ||
+ 	    is_multicast_ether_addr(hdr->addr1))
+ 		return RX_CONTINUE;
+diff --git a/net/mac80211/status.c b/net/mac80211/status.c
+index 2731cf5bf052..d221300e59e5 100644
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -648,6 +648,8 @@ void ieee80211_tx_status_noskb(struct ieee80211_hw *hw,
+ 			/* Track when last TDLS packet was ACKed */
+ 			if (test_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH))
+ 				sta->status_stats.last_tdls_pkt_time = jiffies;
++		} else if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
++			return;
+ 		} else {
+ 			ieee80211_lost_packet(sta, info);
+ 		}
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index ea5dfefd765a..c1c27a516e45 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -431,8 +431,8 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
+ 	if (ieee80211_hw_check(&tx->local->hw, QUEUE_CONTROL))
+ 		info->hw_queue = tx->sdata->vif.cab_queue;
+ 
+-	/* no stations in PS mode */
+-	if (!atomic_read(&ps->num_sta_ps))
++	/* no stations in PS mode and no buffered packets */
++	if (!atomic_read(&ps->num_sta_ps) && skb_queue_empty(&ps->bc_buf))
+ 		return TX_CONTINUE;
+ 
+ 	info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
+diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
+index 1f0687d8e3d7..62fca77bf3c7 100644
+--- a/net/sunrpc/auth_gss/auth_gss.c
++++ b/net/sunrpc/auth_gss/auth_gss.c
+@@ -1722,6 +1722,7 @@ priv_release_snd_buf(struct rpc_rqst *rqstp)
+ 	for (i=0; i < rqstp->rq_enc_pages_num; i++)
+ 		__free_page(rqstp->rq_enc_pages[i]);
+ 	kfree(rqstp->rq_enc_pages);
++	rqstp->rq_release_snd_buf = NULL;
+ }
+ 
+ static int
+@@ -1730,6 +1731,9 @@ alloc_enc_pages(struct rpc_rqst *rqstp)
+ 	struct xdr_buf *snd_buf = &rqstp->rq_snd_buf;
+ 	int first, last, i;
+ 
++	if (rqstp->rq_release_snd_buf)
++		rqstp->rq_release_snd_buf(rqstp);
++
+ 	if (snd_buf->page_len == 0) {
+ 		rqstp->rq_enc_pages_num = 0;
+ 		return 0;
+diff --git a/scripts/Makefile.extrawarn b/scripts/Makefile.extrawarn
+index abe5f47b1ab0..93e23a73b232 100644
+--- a/scripts/Makefile.extrawarn
++++ b/scripts/Makefile.extrawarn
+@@ -10,6 +10,8 @@
+ # are not supported by all versions of the compiler
+ # ==========================================================================
+ 
++KBUILD_CFLAGS += $(call cc-disable-warning, packed-not-aligned)
++
+ ifeq ("$(origin W)", "command line")
+   export KBUILD_ENABLE_EXTRA_GCC_CHECKS := $(W)
+ endif
+@@ -25,6 +27,7 @@ warning-1 += -Wold-style-definition
+ warning-1 += $(call cc-option, -Wmissing-include-dirs)
+ warning-1 += $(call cc-option, -Wunused-but-set-variable)
+ warning-1 += $(call cc-option, -Wunused-const-variable)
++warning-1 += $(call cc-option, -Wpacked-not-aligned)
+ warning-1 += $(call cc-disable-warning, missing-field-initializers)
+ 
+ warning-2 := -Waggregate-return
+diff --git a/scripts/unifdef.c b/scripts/unifdef.c
+index 7493c0ee51cc..db00e3e30a59 100644
+--- a/scripts/unifdef.c
++++ b/scripts/unifdef.c
+@@ -395,7 +395,7 @@ usage(void)
+  * When we have processed a group that starts off with a known-false
+  * #if/#elif sequence (which has therefore been deleted) followed by a
+  * #elif that we don't understand and therefore must keep, we edit the
+- * latter into a #if to keep the nesting correct. We use strncpy() to
++ * latter into a #if to keep the nesting correct. We use memcpy() to
+  * overwrite the 4 byte token "elif" with "if  " without a '\0' byte.
+  *
+  * When we find a true #elif in a group, the following block will
+@@ -450,7 +450,7 @@ static void Idrop (void) { Fdrop();  ignoreon(); }
+ static void Itrue (void) { Ftrue();  ignoreon(); }
+ static void Ifalse(void) { Ffalse(); ignoreon(); }
+ /* modify this line */
+-static void Mpass (void) { strncpy(keyword, "if  ", 4); Pelif(); }
++static void Mpass (void) { memcpy(keyword, "if  ", 4); Pelif(); }
+ static void Mtrue (void) { keywordedit("else");  state(IS_TRUE_MIDDLE); }
+ static void Melif (void) { keywordedit("endif"); state(IS_FALSE_TRAILER); }
+ static void Melse (void) { keywordedit("endif"); state(IS_FALSE_ELSE); }
+diff --git a/sound/core/control.c b/sound/core/control.c
+index bd01d492f46a..2be860a446a2 100644
+--- a/sound/core/control.c
++++ b/sound/core/control.c
+@@ -346,6 +346,40 @@ static int snd_ctl_find_hole(struct snd_card *card, unsigned int count)
+ 	return 0;
+ }
+ 
++/* add a new kcontrol object; call with card->controls_rwsem locked */
++static int __snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol)
++{
++	struct snd_ctl_elem_id id;
++	unsigned int idx;
++	unsigned int count;
++
++	id = kcontrol->id;
++	if (id.index > UINT_MAX - kcontrol->count)
++		return -EINVAL;
++
++	if (snd_ctl_find_id(card, &id)) {
++		dev_err(card->dev,
++			"control %i:%i:%i:%s:%i is already present\n",
++			id.iface, id.device, id.subdevice, id.name, id.index);
++		return -EBUSY;
++	}
++
++	if (snd_ctl_find_hole(card, kcontrol->count) < 0)
++		return -ENOMEM;
++
++	list_add_tail(&kcontrol->list, &card->controls);
++	card->controls_count += kcontrol->count;
++	kcontrol->id.numid = card->last_numid + 1;
++	card->last_numid += kcontrol->count;
++
++	id = kcontrol->id;
++	count = kcontrol->count;
++	for (idx = 0; idx < count; idx++, id.index++, id.numid++)
++		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id);
++
++	return 0;
++}
++
+ /**
+  * snd_ctl_add - add the control instance to the card
+  * @card: the card instance
+@@ -362,45 +396,18 @@ static int snd_ctl_find_hole(struct snd_card *card, unsigned int count)
+  */
+ int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol)
+ {
+-	struct snd_ctl_elem_id id;
+-	unsigned int idx;
+-	unsigned int count;
+ 	int err = -EINVAL;
+ 
+ 	if (! kcontrol)
+ 		return err;
+ 	if (snd_BUG_ON(!card || !kcontrol->info))
+ 		goto error;
+-	id = kcontrol->id;
+-	if (id.index > UINT_MAX - kcontrol->count)
+-		goto error;
+ 
+ 	down_write(&card->controls_rwsem);
+-	if (snd_ctl_find_id(card, &id)) {
+-		up_write(&card->controls_rwsem);
+-		dev_err(card->dev, "control %i:%i:%i:%s:%i is already present\n",
+-					id.iface,
+-					id.device,
+-					id.subdevice,
+-					id.name,
+-					id.index);
+-		err = -EBUSY;
+-		goto error;
+-	}
+-	if (snd_ctl_find_hole(card, kcontrol->count) < 0) {
+-		up_write(&card->controls_rwsem);
+-		err = -ENOMEM;
+-		goto error;
+-	}
+-	list_add_tail(&kcontrol->list, &card->controls);
+-	card->controls_count += kcontrol->count;
+-	kcontrol->id.numid = card->last_numid + 1;
+-	card->last_numid += kcontrol->count;
+-	id = kcontrol->id;
+-	count = kcontrol->count;
++	err = __snd_ctl_add(card, kcontrol);
+ 	up_write(&card->controls_rwsem);
+-	for (idx = 0; idx < count; idx++, id.index++, id.numid++)
+-		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id);
++	if (err < 0)
++		goto error;
+ 	return 0;
+ 
+  error:
+@@ -1322,9 +1329,12 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
+ 		kctl->tlv.c = snd_ctl_elem_user_tlv;
+ 
+ 	/* This function manage to free the instance on failure. */
+-	err = snd_ctl_add(card, kctl);
+-	if (err < 0)
+-		return err;
++	down_write(&card->controls_rwsem);
++	err = __snd_ctl_add(card, kctl);
++	if (err < 0) {
++		snd_ctl_free_one(kctl);
++		goto unlock;
++	}
+ 	offset = snd_ctl_get_ioff(kctl, &info->id);
+ 	snd_ctl_build_ioff(&info->id, kctl, offset);
+ 	/*
+@@ -1335,10 +1345,10 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
+ 	 * which locks the element.
+ 	 */
+ 
+-	down_write(&card->controls_rwsem);
+ 	card->user_ctl_count++;
+-	up_write(&card->controls_rwsem);
+ 
++ unlock:
++	up_write(&card->controls_rwsem);
+ 	return 0;
+ }
+ 
+diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
+index 3de88974eeb6..0ad194002c0c 100644
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -35,6 +35,7 @@
+ #include <sound/timer.h>
+ #include <sound/minors.h>
+ #include <linux/uio.h>
++#include <linux/delay.h>
+ 
+ /*
+  *  Compatibility
+@@ -78,12 +79,12 @@ static DECLARE_RWSEM(snd_pcm_link_rwsem);
+  * and this may lead to a deadlock when the code path takes read sem
+  * twice (e.g. one in snd_pcm_action_nonatomic() and another in
+  * snd_pcm_stream_lock()).  As a (suboptimal) workaround, let writer to
+- * spin until it gets the lock.
++ * sleep until all the readers are completed without blocking by writer.
+  */
+-static inline void down_write_nonblock(struct rw_semaphore *lock)
++static inline void down_write_nonfifo(struct rw_semaphore *lock)
+ {
+ 	while (!down_write_trylock(lock))
+-		cond_resched();
++		msleep(1);
+ }
+ 
+ /**
+@@ -1825,7 +1826,7 @@ static int snd_pcm_link(struct snd_pcm_substream *substream, int fd)
+ 		res = -ENOMEM;
+ 		goto _nolock;
+ 	}
+-	down_write_nonblock(&snd_pcm_link_rwsem);
++	down_write_nonfifo(&snd_pcm_link_rwsem);
+ 	write_lock_irq(&snd_pcm_link_rwlock);
+ 	if (substream->runtime->status->state == SNDRV_PCM_STATE_OPEN ||
+ 	    substream->runtime->status->state != substream1->runtime->status->state ||
+@@ -1872,7 +1873,7 @@ static int snd_pcm_unlink(struct snd_pcm_substream *substream)
+ 	struct snd_pcm_substream *s;
+ 	int res = 0;
+ 
+-	down_write_nonblock(&snd_pcm_link_rwsem);
++	down_write_nonfifo(&snd_pcm_link_rwsem);
+ 	write_lock_irq(&snd_pcm_link_rwlock);
+ 	if (!snd_pcm_stream_linked(substream)) {
+ 		res = -EALREADY;
+@@ -2224,7 +2225,8 @@ int snd_pcm_hw_constraints_complete(struct snd_pcm_substream *substream)
+ 
+ static void pcm_release_private(struct snd_pcm_substream *substream)
+ {
+-	snd_pcm_unlink(substream);
++	if (snd_pcm_stream_linked(substream))
++		snd_pcm_unlink(substream);
+ }
+ 
+ void snd_pcm_release_substream(struct snd_pcm_substream *substream)
+diff --git a/sound/isa/wss/wss_lib.c b/sound/isa/wss/wss_lib.c
+index 913b731d2236..f40330ddb9b2 100644
+--- a/sound/isa/wss/wss_lib.c
++++ b/sound/isa/wss/wss_lib.c
+@@ -1531,7 +1531,6 @@ static int snd_wss_playback_open(struct snd_pcm_substream *substream)
+ 	if (err < 0) {
+ 		if (chip->release_dma)
+ 			chip->release_dma(chip, chip->dma_private_data, chip->dma1);
+-		snd_free_pages(runtime->dma_area, runtime->dma_bytes);
+ 		return err;
+ 	}
+ 	chip->playback_substream = substream;
+@@ -1572,7 +1571,6 @@ static int snd_wss_capture_open(struct snd_pcm_substream *substream)
+ 	if (err < 0) {
+ 		if (chip->release_dma)
+ 			chip->release_dma(chip, chip->dma_private_data, chip->dma2);
+-		snd_free_pages(runtime->dma_area, runtime->dma_bytes);
+ 		return err;
+ 	}
+ 	chip->capture_substream = substream;
+diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c
+index 82259ca61e64..c4840fda44b4 100644
+--- a/sound/pci/ac97/ac97_codec.c
++++ b/sound/pci/ac97/ac97_codec.c
+@@ -824,7 +824,7 @@ static int snd_ac97_put_spsa(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_
+ {
+ 	struct snd_ac97 *ac97 = snd_kcontrol_chip(kcontrol);
+ 	int reg = kcontrol->private_value & 0xff;
+-	int shift = (kcontrol->private_value >> 8) & 0xff;
++	int shift = (kcontrol->private_value >> 8) & 0x0f;
+ 	int mask = (kcontrol->private_value >> 16) & 0xff;
+ 	// int invert = (kcontrol->private_value >> 24) & 0xff;
+ 	unsigned short value, old, new;
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index ecb07fb036af..f964743b104c 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2363,6 +2363,10 @@ static const struct pci_device_id azx_ids[] = {
+ 	/* AMD Hudson */
+ 	{ PCI_DEVICE(0x1022, 0x780d),
+ 	  .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
++	/* AMD Stoney */
++	{ PCI_DEVICE(0x1022, 0x157a),
++	  .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB |
++			 AZX_DCAPS_PM_RUNTIME },
+ 	/* AMD Raven */
+ 	{ PCI_DEVICE(0x1022, 0x15e3),
+ 	  .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB |
+diff --git a/sound/pci/trident/trident.c b/sound/pci/trident/trident.c
+index cedf13b64803..2f18b1cdc2cd 100644
+--- a/sound/pci/trident/trident.c
++++ b/sound/pci/trident/trident.c
+@@ -123,7 +123,7 @@ static int snd_trident_probe(struct pci_dev *pci,
+ 	} else {
+ 		strcpy(card->shortname, "Trident ");
+ 	}
+-	strcat(card->shortname, card->driver);
++	strcat(card->shortname, str);
+ 	sprintf(card->longname, "%s PCI Audio at 0x%lx, irq %d",
+ 		card->shortname, trident->port, trident->irq);
+ 
+diff --git a/sound/sparc/cs4231.c b/sound/sparc/cs4231.c
+index 30bdc971883b..017e241b0ec9 100644
+--- a/sound/sparc/cs4231.c
++++ b/sound/sparc/cs4231.c
+@@ -1146,10 +1146,8 @@ static int snd_cs4231_playback_open(struct snd_pcm_substream *substream)
+ 	runtime->hw = snd_cs4231_playback;
+ 
+ 	err = snd_cs4231_open(chip, CS4231_MODE_PLAY);
+-	if (err < 0) {
+-		snd_free_pages(runtime->dma_area, runtime->dma_bytes);
++	if (err < 0)
+ 		return err;
+-	}
+ 	chip->playback_substream = substream;
+ 	chip->p_periods_sent = 0;
+ 	snd_pcm_set_sync(substream);
+@@ -1167,10 +1165,8 @@ static int snd_cs4231_capture_open(struct snd_pcm_substream *substream)
+ 	runtime->hw = snd_cs4231_capture;
+ 
+ 	err = snd_cs4231_open(chip, CS4231_MODE_RECORD);
+-	if (err < 0) {
+-		snd_free_pages(runtime->dma_area, runtime->dma_bytes);
++	if (err < 0)
+ 		return err;
+-	}
+ 	chip->capture_substream = substream;
+ 	chip->c_periods_sent = 0;
+ 	snd_pcm_set_sync(substream);
+diff --git a/sound/usb/card.c b/sound/usb/card.c
+index 83336bb6333e..084d413d7a37 100644
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -589,9 +589,12 @@ static int usb_audio_probe(struct usb_interface *intf,
+ 
+  __error:
+ 	if (chip) {
++		/* chip->active is inside the chip->card object,
++		 * decrement before memory is possibly returned.
++		 */
++		atomic_dec(&chip->active);
+ 		if (!chip->num_interfaces)
+ 			snd_card_free(chip->card);
+-		atomic_dec(&chip->active);
+ 	}
+ 	mutex_unlock(&register_mutex);
+ 	return err;